{"cve":"CVE-2026-35370","nvd":{"published":"2026-04-22T17:16:40.833","modified":"2026-10-26T21:10:00.170","status":"Analyzed","description":"The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":4.4},"cwes":["CWE-863"],"references":["https://github.com/uutils/coreutils/issues/10006","https://github.com/uutils/coreutils/issues/10006"],"products":["uutils:coreutils"],"source":"nvd","synced_at":"2026-10-26T21:38:48.864438205+00:00"},"epss":{"cve":"CVE-2026-35370","score":0.00108,"percentile":0.0119,"date":"2026-10-26"},"kev":null,"osv":[{"id":"GHSA-47c7-qrm7-mqw7","url":"https://osv.dev/vulnerability/GHSA-47c7-qrm7-mqw7","summary":"id: groups= computed from real GID instead of effective GID","modified":"2026-07-06T20:41:09.644631Z","packages":[{"ecosystem":"crates.io","name":"uu_id","purl":"pkg:cargo/uu_id","ranges":["<0.6.0"],"fixed":["0.6.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}