{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://github.com/ogham/rust-users/","packageName":"rust-users","product":"","source":"CNA: redhat","vendor":"","versions":[{"lessThan":"0.11.1","status":"affected","version":"0.8.0","versionType":"semver"}]},{"defaultStatus":"affected","ecosystem":"https://catalog.redhat.com/software/containers/","packageName":"openshift-sandboxed-containers/osc-rhel9-operator","product":"Red Hat OpenShift sandboxed containers 1.10","source":"CNA: redhat","vendor":"Red Hat","versions":[{"lessThan":"*","status":"unaffected","version":"1.10-1753885668","versionType":"rpm"}]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rust-ssh-key-dir","product":"Red Hat Enterprise Linux 10","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rust-afterburn","product":"Red Hat Enterprise Linux 9","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"unaffected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"kata-containers","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rust-afterburn","product":"Red Hat OpenShift Container Platform 4","source":"CNA: redhat","vendor":"Red Hat","versions":[]},{"defaultStatus":"affected","ecosystem":"https://access.redhat.com/downloads/content/package-browser/","packageName":"rhtpa/rhtpa-trustification-service-rhel9","product":"Red Hat Trusted Profile Analyzer","source":"CNA: redhat","vendor":"Red Hat","versions":[]}],"cveId":"CVE-2025-5791","cwes":["CWE-266"],"description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","epss":{"date":"2026-11-04","percentile":0.10645,"score":0.00205},"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: redhat","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},{"score":7.1,"severity":"high","source":"NVD: secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}],"modifiedAt":1793830658203,"publishedAt":1749215407157,"references":[{"source":"CNA: redhat","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"https://access.redhat.com/errata/RHSA-2025:12359"},{"source":"CNA: redhat","tags":["vdb-entry","x_refsource_REDHAT"],"url":"https://access.redhat.com/security/cve/CVE-2025-5791"},{"source":"CNA: redhat","tags":["issue-tracking","x_refsource_REDHAT"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370001"},{"source":"CNA: redhat","tags":[],"url":"https://crates.io/crates/users"},{"source":"CNA: redhat","tags":[],"url":"https://github.com/ogham/rust-users/issues/44"},{"source":"CNA: redhat","tags":[],"url":"https://rustsec.org/advisories/RUSTSEC-2025-0040.html"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/errata/RHSA-2025:12359"},{"source":"secalert@redhat.com","tags":[],"url":"https://access.redhat.com/security/cve/CVE-2025-5791"},{"source":"secalert@redhat.com","tags":[],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370001"},{"source":"secalert@redhat.com","tags":[],"url":"https://crates.io/crates/users"},{"source":"secalert@redhat.com","tags":[],"url":"https://github.com/ogham/rust-users/issues/44"},{"source":"secalert@redhat.com","tags":[],"url":"https://rustsec.org/advisories/RUSTSEC-2025-0040.html"}],"remediation":[],"revision":"de715e064d701d02c250d3890d466dda45a8e944ff5ac8dd2940b093b833fa5e","sources":[{"modifiedAt":1793828133423,"name":"CNA: redhat","retrievedAt":1793830231966,"url":"https://www.cve.org/CVERecord?id=CVE-2025-5791"},{"modifiedAt":1793830658203,"name":"NVD","retrievedAt":1793837794609,"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5791"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793830253866,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-5791"}],"ssvc":{"assessedAt":1749217243009,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"Users: `root` appended to group listings","updatedAt":1793837794609}