CVE-2026-123040: High severity vulnerability
An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
TrueConf Server (Linux)to a version that resolves this vulnerability.Fixed in 5.5.6
Event History
Frequently Asked Questions
Which deployments are affected?
TrueConf Server on Linux is affected in versions from 4.7.2 up to, but not including, 5.5.6. The issue applies where the attacker can execute code as the trueconf user.
What access does an attacker need to exploit this?
An attacker must first obtain arbitrary code execution on the host as the trueconf user, such as by exploiting another vulnerability. The issue then allows elevation from trueconf to root.
Is this remotely exploitable without prior access?
The provided vector is local and requires low privileges. The vulnerability description does not indicate that an unauthenticated remote attacker can exploit it directly.