Users: `root` appended to group listings
Historical advisory recorded 4 Nov 2026 22:54:02 UTC. Read the latest advisory.
cve-program · CVE-2025-5791
PublishedA flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2025-5791
PublishedUsers: `root` appended to group listings
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
- Source published
- 6 Jun 2025 13:10:07 UTC
- Source modified
- 4 Nov 2026 21:35:33 UTC
- Saved here
- 4 Nov 2026 22:54:02 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N