CVE-2026-111324: rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments running rustdesk-api through version 2.7 are affected if the POST /api/sysinfo endpoint is reachable by an unauthenticated attacker. No existing account or credentials are required.
What does an attacker need to exploit it?
The attacker needs only the target device ID. They can submit it to POST /api/sysinfo to overwrite the associated peer's hostname, username, OS, and UUID without UUID verification.
What is the likely impact after peer data is overwritten?
An attacker can present the overwritten UUID to log in and rebind the peer to the attacker's account. The stated impact is unauthorized modification of existing peer records and account reassignment of the affected peer.