TrueConf Server: Local privilege escalation (CVE-2026-123040)

CVE-2026-123040 is a security vulnerability in TrueConf Server for Linux that permits a local privilege escalation. An attacker who has already successfully executed arbitrary code as the trueconf user can abuse this flaw to obtain root privileges. This vulnerability impacts TrueConf Server versions 4.7.2 up to, but not including, 5.5.6.

Impact

Successful exploitation results in full root access to the underlying Linux system, granting an attacker complete control over the server environment, including the ability to modify, delete, or exfiltrate sensitive data and manipulate system configurations.

Recommendation

• Update TrueConf Server to version 5.5.6 or later on all affected Linux installations to remediate CVE-2026-123040.
• Conduct an inventory of all TrueConf Server instances to identify vulnerable versions 4.7.2 through 5.5.5.
• Review system logs for signs of unauthorized access or suspicious process execution by the trueconf user account.