Report incorrect group information in users

Author: danth

crates/users/RUSTSEC-0000-0000.md

@@ -0,0 +1,25 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "users"
+date = "2025-01-15"
+url = "https://github.com/ogham/rust-users/issues/44"
+categories = ["privilege-escalation"]
+
+[versions]
+patched = []
+unaffected = ["<= 0.7.0"]
+```
+
+# `root` appended to group listings
+
+Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.
+
+This affects both:
+
+- The supplementary groups of a user
+- The group access list of the current process
+
+If the caller uses this information for access control, this may lead to privilege escalation.
+
+This crate is not currently maintained, so a patched version is not available.