7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5791

CVE-2025-5791: users may append `root` to group listings

Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.

This affects both:

The supplementary groups of a user
The group access list of the current process

If the caller uses this information for access control, this may lead to privilege escalation.

This crate is not currently maintained, so a patched version is not available.

Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.

Recommended alternatives

uzers (an actively maintained fork of the users crate)
sysinfo

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5791

CVE-2025-5791:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
users	rust	>= 0.8.0, <= 0.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-5791 / GHSA-m65q-v92h-cm7q) in the users crate (versions >= 0.8.0, <= 0.11.0) stems from improper handling of fixed-size buffers when interfacing with libc functions (getgroups and getgrouplist) to retrieve group information.

The root cause is consistent across two key functions: users::base::group_access_list (which provides the group access list of the current process) and users::base::get_user_groups (which provides the supplementary groups of a user and is called by users::User::groups).

In both functions:

A buffer of 1024 elements (gid_t or i32 on macOS) is allocated and initialized with 0. The GID 0 typically corresponds to the root group.
A libc function (getgroups or getgrouplist) is called to fill this buffer with actual group IDs. These functions also indicate how many group IDs were actually written.
The Rust code then fails to limit its processing to only the portion of the buffer that was filled with valid data. Instead, it iterates over the entire 1024-element buffer (or a version of it modified by dedup that still includes extraneous zeros if the buffer wasn't full).
Consequently, if the actual number of groups is less than 1024, the remaining zero-initialized elements in the buffer are treated as valid GIDs. These 0s are then resolved to the root group, causing root to be incorrectly appended to the resulting group list.

This behavior leads to privilege escalation if an application relies on the accuracy of these group lists for access control decisions, as it might incorrectly grant root privileges. The vulnerability does not manifest if the correct group listing happens to be exactly 1024 groups, as the buffer would be completely filled with legitimate data in that specific scenario.

The crate is unmaintained, and no patched version is available. Downgrading to versions older than 0.8.0 or using alternative crates like uzers or sysinfo are the recommended workarounds.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-5791: users may append `root` to group listings

Recommended alternatives

CVE-2025-5791:

7.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

CVE-2025-5791: users may append `root` to group listings

Recommended alternatives

Basic Information

Basic Information

7.1

7.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

7.1

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-5791: users may append `root` to group listings

Recommended alternatives

CVE-2025-5791:

7.1

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

CVE-2025-5791: users may append `root` to group listings

Recommended alternatives

Basic Information

Basic Information

7.1

7.1

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI