The vulnerability occurs in cosmic‑greeter during the user authentication process. A race condition between privilege dropping and subsequent checks allows an attacker to regain higher privileges that were intended to be relinquished. This results in privilege escalation, potentially enabling the attacker to gain unauthorized access to system resources. The flaw is categorized as an unauthorized privilege escalation (CWE‑271) combined with a time‑of‑check/time‑of‑use race (CWE‑367).

The flaw affects Pop!_OS cosmic‑greeter versions prior to the merge of pull request 426 from the project’s GitHub repository. All users running the base package of cosmic‑greeter without the patch are vulnerable. The patch is available via the referenced issue and PR and addresses the TOCTOU race in the GetUserData method of com.system76.CosmicGreeter.

The CVSS base score is 5.8, reflecting moderate severity. No EPSS data is available, and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet observed. Nevertheless, the attack vector is inferred to be local; a user with the ability to influence the greeter’s privilege‑dropping logic could trigger the race condition to elevate privileges. Because the exploit requires a race during startup, it may be challenging but remains a valid concern for systems requiring strict privilege separation.