CVE-2025-67859CWE-287

Polkit Authorization Check can be Bypassed in the TLP power daemon

Medium · published January 14, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
10.1
In the wild
Unconfirmed
What it is

A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power

profile in use as well as the daemon’s log settings.This issue affects TLP: from 1.9 before 1.9.1.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
EPSS
0.00206 · 10.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-01-14T11:34Z
EPSS history
Timeline
  • 14 JAN 11:34Z
    Polkit Authorization Check can be Bypassed in the TLP power daemon
    cvelistv5