CVE-2020-16126: freedesktop accountsservice Improper Privilege Management
Vulnerability summary
CVE-2020-16126 is a low (CVSS 3.3) Improper Privilege Management vulnerability in freedesktop accountsservice. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 11-11-2020PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
An Ubuntu-specific modification to AccountsService in versions before 0.6.55-0ubuntu13.2, among other earlier versions, improperly dropped the ruid, allowing untrusted users to send signals to AccountService, thus stopping it from handling D-Bus messages in a timely fashion.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
0.00 pp
From 0.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundGhsl 2020 187 Accountsservice Drop Privs Dos
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Freedesktop1 product
- accountsservice≥ 0.6.35-0ubuntu7.3, < 0.6.35-0ubuntu7.3+esm2 | ≥ 0.6.40-2ubuntu11, < 0.6.40-2ubuntu11.6 | ≥ 0.6.45-1ubuntu1, < 0.6.45-1ubuntu1.3 | ≥ 0.6.55-0ubuntu, < 0.6.55-0ubuntu12~20.04.4 | ≥ 0.6.55-0ubuntu13, < 0.6.55-0ubuntu13.2 | < 0.6.55
Ubuntu1 product
- accountsservice< 0.6.35-0ubuntu7.3+esm2 | < 0.6.40-2ubuntu11.6 | < 0.6.45-1ubuntu1.3 | < 0.6.55-0ubuntu12~20.04.4
2 vendors · 2 products
References
5 links- securitylab.github.com/advisories/GHSL-2020-187-accountsservice-drop-privs-DOSX Refsource MISCExploitThird Party Advisory