{"id":"CVE-2025-67859","aliases":["DEBIAN-CVE-2025-67859","EUVD-2026-2520","GHSA-7p5m-65pg-9vg4","UBUNTU-CVE-2025-67859","openSUSE-RU-2026:20767-1","openSUSE-SU-2026:10098-1"],"status":"published","title":"Polkit Authorization Check can be Bypassed in the TLP power daemon","description":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power\nprofile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.","severity":{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00206,"percentile":0.10672,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287"],"published":"2026-01-08T00:00:00Z","modified":"2026-09-01T20:05:56Z","fixes":[{"ecosystem":"Debian:14","package":"tlp","fixed_in":["1.9.1-1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"tlp","fixed_in":["1.8.0-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:14","package":"tlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.1-1"}]}],"versions":["1.8.0-1","1.9.0-1","1.9.1-1~bpo12+1","1.9.1-1~bpo13+1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"tlp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.0-1.1"}]}]}],"products":[{"vendor":"https://github.com/linrunner","product":"tlp"}],"references":[{"url":"https://security.opensuse.org/2026/01/07/tlp-polkit-authentication-bypass.html"},{"url":"https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67859"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-67859"},{"url":"https://github.com/advisories/GHSA-7p5m-65pg-9vg4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-67859","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-67859","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-67859","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/01/07/8","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1058983","tags":["report"]},{"url":"https://bugzilla.suse.com/1177313","tags":["report"]},{"url":"https://bugzilla.suse.com/1179635","tags":["report"]},{"url":"https://bugzilla.suse.com/1180495","tags":["report"]},{"url":"https://bugzilla.suse.com/1180496","tags":["report"]},{"url":"https://bugzilla.suse.com/1181279","tags":["report"]},{"url":"https://bugzilla.suse.com/1183235","tags":["report"]},{"url":"https://bugzilla.suse.com/1190631","tags":["report"]},{"url":"https://bugzilla.suse.com/1224202","tags":["report"]},{"url":"https://bugzilla.suse.com/1254768","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-67859","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-67859","title":"Polkit Authorization Check can be Bypassed in the TLP power daemon","description":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power\nprofile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.","status":"published","published":"2026-01-14T11:34:12.479Z","modified":"2026-01-14T16:08:41.48Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:32:51.880027Z"}],"euvd":[{"id":"EUVD-2026-2520","description":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power\nprofile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.","status":"published","published":"2026-01-14T11:34:12Z","modified":"2026-01-14T16:08:41Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:48:51.744142Z"}],"ghsa":[{"id":"GHSA-7p5m-65pg-9vg4","title":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the...","description":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power\nprofile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.","status":"published","published":"2026-01-14T12:31:38Z","modified":"2026-01-14T12:31:48Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:05:36.376178Z"}],"nvd":[{"id":"CVE-2025-67859","description":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power\nprofile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.","status":"published","published":"2026-01-14T12:16:32.367Z","modified":"2026-06-17T09:58:11.997Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:11:57.915063Z"}],"osv":[{"id":"DEBIAN-CVE-2025-67859","description":"A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.","status":"published","published":"2026-01-14T12:16:32.367Z","modified":"2026-09-01T20:05:56.851890418Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:47.697959Z"},{"id":"openSUSE-RU-2026:20767-1","title":"Recommended update for tlp","description":"This update for tlp fixes the following issues:\n\nIntroduce tlp.\n","status":"published","published":"2026-05-18T14:42:22Z","modified":"2026-05-19T08:45:04.866316249Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2026:10098-1","title":"tlp-1.8.0-1.1 on GA media","description":"These are all security issues fixed in the tlp-1.8.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-01-26T00:00:00Z","modified":"2026-03-23T04:54:26.950311Z","updated_at":"2026-11-02T16:58:38.101535Z"},{"id":"UBUNTU-CVE-2025-67859","description":"[Unknown description]","status":"withdrawn","published":"2026-01-08T00:00:00Z","modified":"2026-01-14T22:16:40.212994Z","updated_at":"2026-11-02T16:55:52.345622Z"}]}}