---
id: CVE-2026-35371
aliases:
  - GHSA-xv5w-cw7x-72gj
title: 'id: pretty-print uses effective GID instead of effective UID for name lookup'
summary: 'id: pretty-print uses effective GID instead of effective UID for name lookup'
severity: low
cvss: 3.3
cwe:
  - CWE-451
vendor: uu_id
product: uu_id
ecosystem: rust
affected:
  - uu_id < 0.6.0
patched:
  - uu_id 0.6.0
published: '2026-07-06'
updated: '2026-07-06'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-xv5w-cw7x-72gj'
references:
  - url: >-
      https://github.com/uutils/coreutils/security/advisories/GHSA-xv5w-cw7x-72gj
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-35371'
  - url: 'https://github.com/uutils/coreutils/issues/10006'
  - url: 'https://github.com/advisories/GHSA-xv5w-cw7x-72gj'
tags:
  - ghsa
  - rust
epss: 0.00137
epssPercentile: 0.02526
ingestedAt: '2026-07-06T20:46:12.681Z'
---

## Overview

The id utility in uutils coreutils exhibits incorrect behavior in its "pretty print" output when the real UID and effective UID differ. The implementation incorrectly uses the effective GID instead of the effective UID when performing a name lookup for the effective user. This results in misleading diagnostic output that can cause automated scripts or system administrators to make incorrect decisions regarding file permissions or access control.

---
_Zellic finding 3.73. Reported in the Zellic *uutils coreutils Program Security Assessment* (for Canonical, Jan 2026), audited commit `3a07ffc5a9bd4c283e75afa548ba1f1957bad242`._

## Affected packages

- `uu_id < 0.6.0`

## Remediation

Upgrade to a patched release:

- `uu_id 0.6.0`