authd contains a logic error in how it assigns the primary group ID at login, causing a mismatch between a user's UID and GID when the account was created before version 0.5.4 or when the group was manually changed. This results in newly created files and directories being owned by the wrong group, which can deny legitimate access and may grant other local users unintended read or write permissions. The flaw is a local privilege escalation vector that can lead to denial of service or unauthorized access to sensitive data.

The affected product is Canonical’s authd service. Versions prior to 0.6.4 are vulnerable, including those where accounts were created with older authd or where the primary group was manually altered with authctl group set‑gid.

The flaw has a CVSS score of 7.3 and no EPSS data is available. It is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is a local user who triggers an identity provider record update after an existing account has a mismatched UID and GID, or a newly created account before version 0.5.4. Once triggered, an attacker can gain elevated access to files they should not own, leading to data compromise or denial of service. The vulnerability has no publicly known remote exploitation vector.