Report incorrect group information in users

crates/users/RUSTSEC-0000-0000.md

@@ -0,0 +1,34 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "users"
+date = "2025-01-15"
+url = "https://github.com/ogham/rust-users/issues/44"
+categories = ["privilege-escalation"]
+
+[versions]
+patched = []
+unaffected = ["< 0.8.0"]
+```
+
+# `root` appended to group listings
+
+Affected versions append `root` to group listings, unless the correct listing
+has exactly 1024 groups.
+
+This affects both:
+
+- The supplementary groups of a user
+- The group access list of the current process
+
+If the caller uses this information for access control, this may lead to
+privilege escalation.
+
+This crate is not currently maintained, so a patched version is not available.
+
+Versions older than 0.8.0 do not contain the affected functions, so downgrading
+to them is a workaround.
+
+## Recommended alternatives
+- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)
+- [`sysinfo`](https://crates.io/crates/sysinfo)