CVE-2026-111324

MEDIUM 5.3

rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.

CWE	CWE-639
Vendor	lejianwen
Product	rustdesk-api
Published	Oct 15, 2026

Stay Ahead of the Next One

Get instant alerts for lejianwen rustdesk-api

Be the first to know when new medium vulnerabilities affecting lejianwen rustdesk-api are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

lejianwen / rustdesk-api

0 ≤ 2.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@hieuPenguinnn/rustdesk-api-sysinfo-unauth-peer-tamper github.com: https://github.com/lejianwen/rustdesk-api/blob/v2.7/http/router/api.go#L60-L76 github.com: https://github.com/lejianwen/rustdesk-api/blob/v2.7/http/controller/api/peer.go#L26-L57 github.com: https://github.com/lejianwen/rustdesk-api vulncheck.com: https://www.vulncheck.com/advisories/rustdesk-api-through-2.7-authorization-bypass-via-post-api-sysinfo

Credits

hieuPenguinnn