TrueConf Server: Local privilege escalation to root via incorrect default permissions
Summary
TrueConf Server for Linux, versions 4.7.2 up to but not including 5.5.6, grants root privileges through incorrect default permissions (CWE-276). An attacker who already can execute arbitrary code as the user trueconf can escalate privileges to root and fully compromise the host. The attacker needs a local foothold first, and the CNA rates the flaw as not automatable.
Affected
- TrueConf Server (Linux) 4.7.2 up to but not including 5.5.6
- Windows versions are not covered by this CVE record
Fixed in
- Update TrueConf Server (Linux) to version 5.5.6 or newer (per the CNA record; not yet confirmed by a TrueConf advisory)
Workaround
- No vendor mitigation beyond updating is documented.
- The CNA record suggests a full scan with up-to-date anti-virus software.
- Restrict who can run code as the trueconf user (general hardening, not a fix for this CVE).
Exploitation
- No known exploitation of this CVE. CISA SSVC: exploitation none, automatable no, technical impact total.
- No public proof of concept found.
- Separate flaws CVE-2026-72529 and CVE-2026-72530 are actively exploited in TrueConf Server and could provide the initial code execution this CVE requires.
Our recommendation
- Inventory all TrueConf Server hosts and record version and exposure.
- Upgrade Linux hosts to 5.5.6 at minimum, preferably to the latest 5.5.x build.
- Check whether the actively exploited CVE-2026-72529 and CVE-2026-72530 are patched (fixes 5.3.9, 5.4.9 and 5.5.5).
- Limit access to the server, especially port 4307/TCP, to management hosts.
- If an exposed server ran a vulnerable build, check for unexpected script execution and replaced client installers.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Kaspersky ICS CERT advisory KLCERT-26-059 ics-cert.kaspersky.com
- OffSeq Radar: CVE-2026-123040 radar.offseq.com
- Strix AI: CVE-2026-123040 www.strix.ai
- TrueConf Server 5.5.7 release post trueconf.com
- Security Arsenal: TrueConf Server under active exploitation securityarsenal.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 15:27.
Original description (NVD)
An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not including, 5.5.6 installed, running as the user trueconf (by exploiting some other vulnerability), can elevate their privileges to root.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.