This vulnerability allows an authenticated user to gain elevated privileges by exploiting a naming collision in the NSS module. When a user’s mapped CN or short name matches that of a privileged local group—such as "sudo", "wheel" or "docker"—the NSS module mistakenly resolves the group name to the user’s fake primary group. If a system performs group‑based authorization decisions using NSS results, the attacker can inherit the privileges of the target group, effectively escalating locally.

The affected product is the Himmelblau suite from himmelblau‑idm. Versions from 2.0.0‑alpha through just before 2.3.9 and from 3.0.0‑alpha through just before 3.1.1 are compromised, while the patched releases 2.3.9 and 3.1.1 contain the fix.

The CVSS score of 6.3 indicates moderate severity. No EPSS score is available, so the exact exploitation likelihood is uncertain. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is local and requires authentication; any system that relies on NSS for group‑based authorization is at risk. The impact is the ability to acquire privileges of a privileged local group.