Improper Authentication in TLP Affects Open Source Users
CVE-2025-67859

5.1MEDIUM

Key Information:

Vendor

Https://github.com/linrunner

Status
Tlp
Vendor
CVE Published:
14 January 2026

What is CVE-2025-67859?

An improper authentication vulnerability in TLP allows local users to gain unauthorized control over the power profile settings and modify the daemon's logging configurations. This issue affects TLP versions prior to 1.9.1, potentially exposing systems to security risks if exploited.

Affected Version(s)

TLP 1.9 < 1.9.1

References

https://security.opensuse.org/2026/01/07/tlp-polkit-authe...
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67859

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthias Gerstner of SUSE
.