CVE-2026-35370

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations. --- _Zellic finding 3.72. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._

The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations. --- _Zellic finding 3.72. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._

La utilidad id en uutils coreutils calcula erróneamente la sección groups= de su salida. La implementación utiliza el GID real de un usuario en lugar de su GID efectivo para calcular la lista de grupos, lo que lleva a una salida potencialmente divergente en comparación con GNU coreutils. Debido a que muchos scripts y procesos automatizados dependen de la salida de id para tomar decisiones de control de acceso o permisos críticas para la seguridad, esta discrepancia puede llevar a acceso no autorizado o desconfiguraciones de seguridad.