Executive brief
uutils coreutils, a Rust-based implementation of standard Unix command-line tools, contains a flaw in its 'id' utility. The tool incorrectly reports user group information by using a user's permanent identity instead of their temporary 'effective' identity. Because many automated security scripts use this tool to decide who is allowed to access sensitive files or perform administrative tasks, this error could allow unauthorized users to bypass security restrictions or cause systems to be misconfigured.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in the 'id' utility of uutils coreutils. The implementation incorrectly uses the user's real Group ID (GID) rather than the effective GID when computing the group list for output. This results in divergent behavior compared to GNU coreutils, specifically when a process has changed its effective identity (e.g., via setpriv). An attacker with local access could potentially exploit this discrepancy if security-critical scripts or access-control mechanisms rely on the output of 'id' to verify permissions. The issue affects versions up to and including 0.8.0.
Affected products
- uutils coreutils <= 0.8.0
Timeline
- 2026-01-03: disclosed: Issue reported on GitHub repository
- 2026-04-22: advisory: Initial GHSA and NVD publication
- 2026-07-06: other: Advisory withdrawn as a duplicate of GHSA-47c7-qrm7-mqw7