CVE-2026-111324

Received Received - Intake

Authorization Bypass in RustDesk API Leading to Peer Record Overwrite

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-15

Last Modified

2026-10-15

Generated

2026-10-16

AI Q&A

2026-10-16

EPSS Evaluated

N/A

NVD

CVE-2026-111324

Affected Vendors & Products

Vendor	Product	Version / Range
lejianwen	rustdesk-api	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

rustdesk-api through 2.7 has an authorization bypass flaw allowing unauthenticated attackers to overwrite existing peer records by providing only a target device ID to POST /api/sysinfo. Attackers can modify hostname, username, OS, and uuid without verification, then log in using that uuid to rebind the peer to their account.

Detection Guidance

Check for unauthorized POST requests to /api/sysinfo endpoints in your web server logs. Look for requests with only a device ID parameter and no uuid verification. Monitor for unexpected changes in hostname, username, OS, or uuid values in peer records.

Impact Analysis

An attacker could hijack your remote access sessions by rebinding your device to their account, potentially gaining unauthorized control over your system or accessing sensitive data.

Mitigation Strategies

Update rustdesk-api to version 2.7 or later. Implement strict input validation for POST /api/sysinfo requests. Require uuid verification for all peer record modifications. Restrict write access to system information endpoints.

Hi! I’m here to help you understand CVE-2026-111324. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70