CVE-2026-123040 · Runtime
NO FIX YET · SEE WHAT TO DO
TrueConf Server on Linux, versions 4.7.2 up to but not including 5.5.6, lets an attacker who already runs code as the trueconf user gain root privileges. The flaw needs a separate foothold first; it does not by itself give remote access.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only Linux installations of TrueConf Server in the listed version range are exposed. The attacker must already be able to run code as the trueconf service user, so the risk is mainly for servers where another flaw or a compromised account already exists. unknown whether the sources list any other preconditions.
Not affected if version-5.5.6-or-later, windows-install
Who cares linux, self-hosted, trueconf-server
4.7.2 to 5.5.65.5.6 or later (the first fixed version named in the sources)An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.