Read the docs
TI-2026-75072 Aliases CVE-2026-111324

Authorization bypass in rustdesk-api lets attackers overwrite peer records

Priority HIGH 70CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

rustdesk-api through 2.7 contains an authorization bypass that lets unauthenticated attackers overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite the hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their own account. The flaw is tracked as CWE-639 and has a proof-of-concept exploit assessed by CISA SSVC, which rates it as automatable.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00407 35th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
lejianwenrustdesk-apiup to 2.7—No fix listedCNA
  • rustdesk-api Vendorlejianwen Affected up to 2.7 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for rustdesk-api.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-111324
  2. 2026-10-16 Priority changed: MEDIUM → LOW
  3. 2026-10-21 CISA SSVC decision points changed
  4. 2026-10-21 Priority changed: LOW → HIGH

References

Advisory 1

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences