{"id":"CVE-2026-123040","kind":"vulnerability","aliases":["CVE-2026-123040"],"related":[],"title":"TrueConf Server (Linux): local code execution user escalates to root","description":"An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.","summary":"TrueConf Server on Linux, versions 4.7.2 up to but not including 5.5.6, lets an attacker who already runs code as the trueconf user gain root privileges. The flaw needs a separate foothold first; it does not by itself give remote access.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux","runtime","self-hosted","trueconf-server"],"not_affected_if":["version-5.5.6-or-later","windows-install"],"how_to_check":"- Check the installed TrueConf Server version on the Linux host against the affected range `4.7.2` to `5.5.6`","fix":"- TrueConf Server: move to `5.5.6` or later (the first fixed version named in the sources)","status":"open","published_at":"2026-11-11T14:17:32+00:00","first_seen_at":"2026-11-11T14:27:30+00:00","triaged_at":"2026-11-11T14:29:20+00:00","updated_at":"2026-11-11T14:29:20+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-11T14:29:20Z","model":"claude-haiku-5-5","output":{"fix":"- TrueConf Server: move to `5.5.6` or later (the first fixed version named in the sources)","reach":"local","title":"TrueConf Server (Linux): local code execution user escalates to root","impact":"high","summary":"TrueConf Server on Linux, versions 4.7.2 up to but not including 5.5.6, lets an attacker who already runs code as the trueconf user gain root privileges. The flaw needs a separate foothold first; it does not by itself give remote access.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["trueconf-server","linux","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"local user gains root on the server after a prior compromise","analyst_note":"","how_to_check":"- Check the installed TrueConf Server version on the Linux host against the affected range `4.7.2` to `5.5.6`\n- unknown for other checks: the sources do not say which file or setting to inspect","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["windows-install","version-5.5.6-or-later"],"who_is_affected":"Only Linux installations of TrueConf Server in the listed version range are exposed. The attacker must already be able to run code as the trueconf service user, so the risk is mainly for servers where another flaw or a compromised account already exists. unknown whether the sources list any other preconditions.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4549,"output_tokens":523,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123040':13A,16A '-2026':12A,15A '4.7.2':30B,85C '5.5.6':36B,91C 'abil':71C 'access':65B 'alreadi':41B 'arbitrari':74C 'attack':39B,67C 'code':5A,43B,75C 'cve':11A,14A 'elev':104C 'escal':8A 'execut':6A,73C 'exploit':99C 'first':57B 'flaw':52B 'foothold':56B 'gain':48B,69C 'give':63B 'host':21B 'includ':35B,90C 'instal':92C 'let':37B 'linux':3A,17B,28B,82C 'local':4A 'need':53B 'privileg':50B,106C 'remot':64B 'root':10A,49B,108C 'run':42B,93C 'runtim':18B 'self':20B 'self-host':19B 'separ':55B 'server':2A,24B,26B,81C 'system':78C 'trueconf':1A,23B,25B,46B,80C,97C 'trueconf-serv':22B 'user':7A,47B,96C 'version':29B,83C 'vulner':102C","nicknames":[],"mitigations":[],"who_affected":"Only Linux installations of TrueConf Server in the listed version range are exposed. The attacker must already be able to run code as the trueconf service user, so the risk is mainly for servers where another flaw or a compromised account already exists. unknown whether the sources list any other preconditions.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","linux","runtime","selfhosted","trueconfserver"],"campaign_type":null,"search_a":"'-123040':13A,16A '-2026':12A,15A 'code':5A 'cve':11A,14A 'escal':8A 'execut':6A 'linux':3A 'local':4A 'root':10A 'server':2A 'trueconf':1A 'user':7A","search_b":"'4.7.2':30B '5.5.6':36B 'access':65B 'alreadi':41B 'attack':39B 'code':43B 'first':57B 'flaw':52B 'foothold':56B 'gain':48B 'give':63B 'host':21B 'includ':35B 'let':37B 'linux':17B,28B 'need':53B 'privileg':50B 'remot':64B 'root':49B 'run':42B 'runtim':18B 'self':20B 'self-host':19B 'separ':55B 'server':24B,26B 'trueconf':23B,25B,46B 'trueconf-serv':22B 'user':47B 'version':29B","search_c":"'4.7.2':85C '5.5.6':91C 'abil':71C 'arbitrari':74C 'attack':67C 'code':75C 'elev':104C 'execut':73C 'exploit':99C 'gain':69C 'includ':90C 'instal':92C 'linux':82C 'privileg':106C 'root':108C 'run':93C 'server':81C 'system':78C 'trueconf':80C,97C 'user':96C 'version':83C 'vulner':102C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T14:17:32+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"vulnerability@kaspersky.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123040","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123040","severity":null,"published_at":"2026-11-11T14:17:32+00:00","modified_at":"2026-11-11T14:17:32+00:00","first_seen_at":"2026-11-11T14:27:30+00:00","fetched_at":"2026-11-11T14:27:30+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}