Users: `root` appended to group listings
cve-program · CVE-2025-5791
PublishedA flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Read the publisher's advisoryeuvd · EUVD-2025-16945
PublishedA flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Read the publisher's advisorynvd · CVE-2025-5791
PublishedA flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Read the publisher's advisoryosv · GHSA-m65q-v92h-cm7q
PublishedAffected versions append `root` to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege escalation. This crate is not currently maintained, so a patched version is not available. Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround. ## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)
Read the publisher's advisoryosv · RUSTSEC-2025-0040
PublishedAffected versions append `root` to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege escalation. This crate is not currently maintained, so a patched version is not available. Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround. ## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)
Read the publisher's advisoryAffected versions, risk and source history
Exploitation and risk
Source statusCISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.
Which CVEs have scores here?
This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.
No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.
cve-program · CVE-2025-5791
PublishedUsers: `root` appended to group listings
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
- Source published
- 6 Jun 2025 13:10:07 UTC
- Source modified
- 4 Nov 2026 21:35:33 UTC
- Saved here
- 4 Nov 2026 22:54:02 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
euvd · EUVD-2025-16945
PublishedA flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the…
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Additional publisher context
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
Original publisher date fields
datePublished: Jun 6, 2025, 1:10:07 PM
dateUpdated: Nov 4, 2026, 9:35:33 PM
16 related source bulletins · separate from aliases
SUSE-SU-2026:23071-1: Security update for afterburn
CVE-2022-24713 · CVE-2024-12224 · CVE-2025-3416 · CVE-2025-5791 · CVE-2026-25541 · CVE-2026-41676 · CVE-2026-41677 · CVE-2026-41678 · CVE-2026-41681 · CVE-2026-41898 · CVE-2026-42327 · CVE-2026-44662 · CVE-2026-45784
SUSE-RU-2025:20961-1: Recommended update for afterburn
CVE-2025-5791
openSUSE-SU-2025:15246-1: mirrorsorcerer-0.1.3~1-1.1 on GA media
CVE-2025-5791
SUSE-RU-2025:21046-1: Recommended update for afterburn
CVE-2025-5791
openSUSE-SU-2025:15628-1: lsd-1.2.0-1.1 on GA media
CVE-2025-5791
RHSA-2025:12359: Red Hat Security Advisory: Red Hat OpenShift sandboxed containers release
CVE-2025-5791 · CVE-2025-22871
openSUSE-SU-2025:15217-1: flake-pilot-3.1.19-1.1 on GA media
CVE-2025-3416 · CVE-2025-5791
openSUSE-SU-2025:15412-1: agama-17+60.68fdb92ec-26.1 on GA media
CVE-2025-5791
SUSE-SU-2025:02166-1: Security update for himmelblau
CVE-2025-3416 · CVE-2025-5791
openSUSE-SU-2025:15335-1: afterburn-5.8.2-3.1 on GA media
CVE-2025-5791
SUSE-SU-2025:3783-1: Security update for afterburn
CVE-2022-24713 · CVE-2024-12224 · CVE-2025-3416 · CVE-2025-5791
msrc_CVE-2025-5791: Users: `root` appended to group listings
CVE-2025-5791
SUSE-SU-2025:3784-1: Security update for afterburn
CVE-2022-24713 · CVE-2024-12224 · CVE-2025-3416 · CVE-2025-5791
SUSE-SU-2025:3786-1: Security update for afterburn
CVE-2022-24713 · CVE-2024-12224 · CVE-2025-3416 · CVE-2025-5791
SUSE-SU-2026:22917-1: Security update for afterburn
CVE-2022-24713 · CVE-2024-12224 · CVE-2025-3416 · CVE-2025-5791 · CVE-2026-25541 · CVE-2026-41676 · CVE-2026-41677 · CVE-2026-41678 · CVE-2026-41681 · CVE-2026-41898 · CVE-2026-42327 · CVE-2026-44662 · CVE-2026-45784
SUSE-SU-2025:3785-1: Security update for afterburn
CVE-2022-24713 · CVE-2024-12224 · CVE-2025-3416 · CVE-2025-5791
- Source published
- Jun 6, 2025, 1:10:07 PM (timezone not stated)
- Source modified
- Nov 4, 2026, 9:35:33 PM (timezone not stated)
- Saved here
- 15 Nov 2026 04:37:09 UTC
- Source terms
- ENISA EUVD · source terms and attribution apply
Original source record · Cite this exact observation · Complete original publisher JSON
Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
EUVD CVSS 3.1 · 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvd · CVE-2025-5791
PublishedA flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the…
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Additional publisher context
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Deferred
Weakness classifications: CWE-266
Original publisher date fields
published: 2025-06-06T14:15:23.137
lastModified: 2026-11-04T22:17:38.203
- Source published
- 6 Jun 2025 14:15:23 UTC
- Source modified
- 4 Nov 2026 22:17:38 UTC
- Saved here
- 6 Nov 2026 07:38:19 UTC
- Source terms
- NIST NVD usage terms; underlying source attribution retained
Original source record · Cite this exact observation · Complete original publisher JSON
Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · [email protected] · Secondary · 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
osv · GHSA-m65q-v92h-cm7q
Publishedusers may append `root` to group listings
Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege escalation. This crate is not currently maintained, so a patched version is not available. Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround. ## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)
- Source published
- 5 Jun 2025 01:17:28 UTC
- Source modified
- 10 Sep 2026 03:50:57 UTC
- Saved here
- 24 Oct 2026 13:19:54 UTC
- Source terms
- GitHub Advisory Database · CC-BY-4.0
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS_V3 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Publisher rating · HIGH
osv · RUSTSEC-2025-0040
Published`root` appended to group listings
Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups. This affects both: - The supplementary groups of a user - The group access list of the current process If the caller uses this information for access control, this may lead to privilege escalation. This crate is not currently maintained, so a patched version is not available. Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround. ## Recommended alternatives - [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate) - [`sysinfo`](https://crates.io/crates/sysinfo)
- Source published
- 15 Jan 2025 12:00:00 UTC
- Source modified
- 28 Oct 2025 06:28:57 UTC
- Saved here
- 24 Oct 2026 13:19:54 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
Source: osv · OSV · upstream source license applies. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.