CVE catalog

CVE-2026-61898

AccountsService vulnerabilities

[CVE catalog]

Severity
High · CVSS 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.19% · Oct 25, 2026

The Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of the AccountsService helper process (real UID 0) via the SetLanguage D-Bus method.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianaccountsservicesid26.27.3-2not affected
Debianaccountsserviceforky23.13.9-8not affected
Debianaccountsservicetrixie23.13.9-7not affected
Debianaccountsservicebookworm22.08.8-6not affected
Ubuntuaccountsservicenoble23.13.9-2ubuntu6.1fixed
Ubuntugir1.2-accountsservice-1.0noble23.13.9-2ubuntu6.1fixed
Ubuntulibaccountsservice-devnoble23.13.9-2ubuntu6.1fixed
Ubuntulibaccountsservice-docnoble23.13.9-2ubuntu6.1fixed
Ubuntulibaccountsservice0noble23.13.9-2ubuntu6.1fixed
Ubuntuaccountsservicepro0.6.55-0ubuntu10vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu11vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.1vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.2vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.4vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.5vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.6vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.7vulnerable
Ubuntuaccountsservicepro0.6.55-0ubuntu12~20.04.7+esm1fixed
Ubuntuaccountsservice22.040.6.55-0ubuntu14vulnerable
Ubuntuaccountsservice22.040.6.55-3ubuntu1vulnerable
Ubuntuaccountsservice22.040.6.55-3ubuntu2vulnerable
Ubuntuaccountsservice22.040.6.55-3ubuntu4vulnerable
Ubuntuaccountsservice22.040.6.55-3ubuntu5vulnerable
Ubuntuaccountsservice22.040.6.55-3ubuntu6vulnerable
Ubuntuaccountsservice22.0422.07.5-2ubuntu1vulnerable
Ubuntuaccountsservice22.0422.07.5-2ubuntu1.3vulnerable
Ubuntuaccountsservice22.0422.07.5-2ubuntu1.4vulnerable
Ubuntuaccountsservice22.0422.07.5-2ubuntu1.5vulnerable
Ubuntuaccountsservice22.0422.07.5-2ubuntu1.6fixed
Ubuntuaccountsservice24.0423.13.9-2ubuntu2vulnerable
Ubuntuaccountsservice24.0423.13.9-2ubuntu4vulnerable
Ubuntuaccountsservice24.0423.13.9-2ubuntu6vulnerable
Ubuntuaccountsservice24.0423.13.9-2ubuntu6.1fixed
Ubuntuaccountsservice26.0423.13.9-7ubuntu1vulnerable
Ubuntuaccountsservice26.0423.13.9-8ubuntu1vulnerable
Ubuntuaccountsservice26.0423.13.9-8ubuntu2vulnerable
Ubuntuaccountsservice26.0423.13.9-8ubuntu4vulnerable
Ubuntuaccountsservice26.0423.13.9-8ubuntu5vulnerable
Ubuntuaccountsservice26.0423.13.9-8ubuntu5.1vulnerable
Ubuntuaccountsservice26.0423.13.9-8ubuntu5.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianaccountsservicesourcesidNot affectedunimportantNot reportedNot reported
DebianaccountsservicesourceforkyNot affectedunimportantNot reportedNot reported
DebianaccountsservicesourcetrixieNot affectedunimportantNot reportedNot reported
DebianaccountsservicesourcebookwormNot affectedunimportantNot reportedNot reported
Ubuntuaccountsservicedebnoble23.13.9-2ubuntu6.1Not reportedNot reportedNot reported
Ubuntugir1.2-accountsservice-1.0debnoble23.13.9-2ubuntu6.1Not reportedNot reportedNot reported
Ubuntulibaccountsservice-devdebnoble23.13.9-2ubuntu6.1Not reportedNot reportedNot reported
Ubuntulibaccountsservice-docdebnoble23.13.9-2ubuntu6.1Not reportedNot reportedNot reported
Ubuntulibaccountsservice0debnoble23.13.9-2ubuntu6.1Not reportedNot reportedNot reported
Ubuntuaccountsservicedebpro0.6.55-0ubuntu12~20.04.7+esm1Not reportedUBUNTU-CVE-2026-61898Not reported
Ubuntuaccountsservicedeb22.0422.07.5-2ubuntu1.6Not reportedUBUNTU-CVE-2026-61898Not reported
Ubuntuaccountsservicedeb24.0423.13.9-2ubuntu6.1Not reportedUBUNTU-CVE-2026-61898Not reported
Ubuntuaccountsservicedeb26.0423.13.9-8ubuntu5.2Not reportedUBUNTU-CVE-2026-61898Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [accountsservice]Not affected
    Details (2)

    • 22.08.8-6 · amd64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

    • 22.08.8-6 · arm64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

  • [gir1.2-accountsservice-1.0]Not affected

    Source package: [accountsservice]

    Details (2)

    • 22.08.8-6 · amd64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

    • 22.08.8-6 · arm64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

  • [libaccountsservice0]Not affected

    Source package: [accountsservice]

    Details (2)

    • 22.08.8-6 · amd64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

    • 22.08.8-6 · arm64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

  • [libaccountsservice-dev]Not affected

    Source package: [accountsservice]

    Details (2)

    • 22.08.8-6 · amd64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

    • 22.08.8-6 · arm64 · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

  • [libaccountsservice-doc]Not affected

    Source package: [accountsservice]

    Details (2)

    • 22.08.8-6 · all · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

    • 22.08.8-6 · all · bookworm

      Not affected

      usn · accountsservice · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]