The vulnerability lies in accountsservice’s handling of the SetIconFile operation for systemd‑homed users. The code path opens a user‑supplied filename without performing the validation and privilege drop that the legacy handler normally executes. Because the accounts‑daemon runs as root, a local attacker who owns a systemd‑homed‑managed account can read any file the daemon can access, resulting in arbitrary file read. This flaw does not provide remote code execution but allows disclosure of potentially sensitive files. The weakness is a violation of least‑privilege controls (CWE‑269).

The flaw affects all Red Hat Enterprise Linux releases from 7 through 10 where the accountsservice package has not been updated to address the issue. Systems that use systemd‑homed for account management on those platforms are vulnerable, whereas systems not utilizing systemd‑homed remain unaffected.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score of less than 1 % indicates a low likelihood of current exploitation. The alert is not listed in the CISA KEV catalog, so no publicly documented exploits exist at this time. The attack vector is local only: an attacker must have local access and a systemd‑homed‑managed account. Once obtained, the attacker can exploit the flaw to read arbitrary files that the accounts‑daemon can read, exposing potentially confidential data.