CVE-2025-5791

Published: Jun 6, 2025Modified: Jul 31, 2025

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploitability: 1.8 / Impact: 5.2

Source: secalert@redhat.com (Secondary)

Description

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.

Related CWEs

Incorrect Privilege Assignment

A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

References (6)

https://access.redhat.com/errata/RHSA-2025:12359

Source: secalert@redhat.com

https://access.redhat.com/security/cve/CVE-2025-5791

Source: secalert@redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=2370001

Source: secalert@redhat.com

https://crates.io/crates/users

Source: secalert@redhat.com

https://github.com/ogham/rust-users/issues/44

Source: secalert@redhat.com

https://rustsec.org/advisories/RUSTSEC-2025-0040.html

Source: secalert@redhat.com

Timeline

No history available yet.