CVE-2026-67609 is a privilege escalation vulnerability in Telenia Software TVox affecting versions 26.5.3 and prior in the 26.x series, and 24.9.21 and prior in the 24.x series. The vulnerability arises from an insecure sudoers configuration file (/etc/sudoers.d/telenia) that allows the apache user to execute /bin/nice without a password. Attackers with access to the apache account can exploit this to execute arbitrary commands as root, effectively gaining full root-level command execution without authentication. This vulnerability is local and requires attacker access to the apache user account.

An attacker with access to the apache user account can escalate privileges to root by exploiting the insecure sudoers configuration. This enables arbitrary command execution with root privileges, potentially compromising the entire system. The vulnerability does not require user interaction and has a low attack complexity, making it a significant security risk on affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the apache user account and review the sudoers configuration to remove or restrict NOPASSWD execution of /bin/nice. Monitor for unauthorized access to the apache account and consider applying temporary configuration changes to mitigate privilege escalation risk.