CVE-2026-44073 PUBLISHED

seteuid failure ignored in auth modules

Assigner: securin
Reserved: 05.05.2026 Published: 21.05.2026 Updated: 21.05.2026

Authentication modules in Netatalk 1.5.0 through 4.4.2 fail to check the return value of seteuid(), which may allow a remote authenticated attacker to retain elevated privileges under error conditions.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS Score: 4

Attack Vector	Network	Scope	Unchanged
Attack Complexity	High	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	Low
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	Netatalk
Product	Netatalk
Versions	Default: unaffected affected from 1.5.0 to 4.4.2 (incl.) Version 4.5.0 is unaffected

Credits

Arjun Basnet from Securin finder

References

Netatalk Security Advisory CVE-2026-44073

Problem Types

Improper Check for Dropped Privileges CWE