CVE-2026-16743: accountsservice Information Disclosure

CVE-2026-16743 Overview

A flaw in accountsservice allows local attackers to read arbitrary files accessible to the accounts-daemon process. The systemd-homed code path for SetIconFile opens a user-supplied filename as root without the validation and privilege drop performed by the classic handler. A local attacker with a systemd-homed-managed account can exploit this weakness to disclose sensitive file contents. The vulnerability is tracked as an improper privilege management issue [CWE-269] affecting the D-Bus accounts-daemon service commonly present on Linux desktop distributions.

Critical Impact
A local, authenticated user with a systemd-homed-managed account can trigger the accounts-daemon to open arbitrary root-readable files, resulting in disclosure of confidential data such as /etc/shadow or other privileged system files.

Affected Products

accountsservice — the upstream freedesktop.org project providing the accounts-daemon D-Bus service
Linux distributions shipping accountsservice with systemd-homed integration (per Red Hat advisory)
Systems where users are managed by systemd-homed

Discovery Timeline

2026-07-24 - CVE-2026-16743 published to NVD
2026-07-24 - Last updated in NVD database

Technical Details for CVE-2026-16743

Vulnerability Analysis

The accountsservice project exposes a D-Bus interface through the accounts-daemon process running as root. One of its methods, SetIconFile, allows a user to designate a file that represents the account's avatar. The classic implementation of this handler validates the caller-supplied path and drops privileges before opening the file, ensuring the daemon only reads files the calling user is entitled to access.

The newer systemd-homed code path skips both safeguards. It opens the user-supplied filename directly with root privileges and without validating that the target file belongs to the caller. Any local user whose account is managed by systemd-homed can therefore instruct the daemon to open a privileged file and observe its contents through the icon-handling logic.

The impact is confined to confidentiality, but the exposed information can include password hashes, private keys, or configuration data used to escalate privileges. Exploitation requires only a valid local session and does not require user interaction beyond the attacker's own D-Bus request.

Root Cause

The root cause is improper privilege management [CWE-269] in the systemd-homed branch of SetIconFile. The handler diverges from the classic path by omitting caller-path validation and by failing to invoke the privilege-drop routine before opening the target file descriptor.

Attack Vector

The attack vector is local. An attacker with an interactive shell or D-Bus session on the host, using a systemd-homed-managed account, issues a SetIconFile D-Bus call targeting a sensitive file path. The accounts-daemon opens the file as root and processes it through the icon workflow, leaking data to the attacker.

No verified public exploit code is available. Refer to the Red Hat CVE-2026-16743 Advisory and the GitLab AccountsService Work Item #138 for upstream analysis.

Detection Methods for CVE-2026-16743

Indicators of Compromise

Unexpected D-Bus calls to org.freedesktop.Accounts.User.SetIconFile referencing paths outside typical user home directories, such as /etc/shadow, /root/, or /var/lib/.
accounts-daemon process opening files that are not owned by the calling user, visible through audit logs.
Presence of systemd-homed-managed accounts on systems where they are not expected.

Detection Strategies

Enable Linux Audit rules on /etc/shadow, private key stores, and other sensitive paths, correlating access by PID with accounts-daemon.
Monitor the D-Bus system bus for SetIconFile invocations and log the requested filename against the caller's UID.
Alert on any file access by accounts-daemon outside the standard icon directories such as /var/lib/AccountsService/icons/ and ~/.face.

Monitoring Recommendations

Forward journald entries from accounts-daemon and systemd-homed to a central log platform for correlation across hosts.
Baseline normal SetIconFile activity per user and alert on deviations, especially requests targeting absolute paths outside home directories.
Track package versions of accountsservice across the fleet to identify hosts still exposed after patches are released.

How to Mitigate CVE-2026-16743

Immediate Actions Required

Apply distribution updates for accountsservice as soon as they are published by your vendor. Track the Red Hat CVE-2026-16743 Advisory for release status.
Inventory all hosts using systemd-homed-managed accounts and prioritize them for patching.
Restrict interactive local access on multi-user systems until fixed packages are deployed.

Patch Information

Upstream tracking is available in the GitLab AccountsService Work Item #138 and the Red Hat Bug Report #2506381. Install updated accountsservice packages from your Linux distribution once they are released. Reboot or restart the accounts-daemon service after upgrade to ensure the fixed binary is loaded.

Workarounds

Disable or avoid systemd-homed account management where feasible, so SetIconFile requests use the classic validated handler.
Mask the accounts-daemon service on systems that do not require it: systemctl mask accounts-daemon.service.
Restrict D-Bus policy for org.freedesktop.Accounts to trusted users via a custom policy file in /etc/dbus-1/system.d/.

bash

# Example: temporarily disable accounts-daemon on servers that do not need it
sudo systemctl stop accounts-daemon.service
sudo systemctl mask accounts-daemon.service

# Verify the service is inactive
systemctl status accounts-daemon.service