CVE-2026-111324— rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
Quick assessment
Affected
lejianwen rustdesk-api
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RustDesk-API 2.7 版本存在一个授权绕过漏洞，允许未经身份验证的攻击者通过仅向 接口提供目标设备 ID，覆盖现有的终端设备记录。攻击者可以在无需验证 UUID 的情况下，覆盖主机名、用户名、操作系统和 UUID 信息，随后通过使用该 UUID 登录并重新绑定该终端设备到自己控制的账户中。
Possible ATT&CK Techniques 3 AI
T1136 · Create Account T1078 · Valid Accounts T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| lejianwen | rustdesk-api | ≤ 2.7 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-111324
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo
Source: CVE Program / CVE List V5
Vulnerability Description
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| lejianwen | rustdesk-api | 0 ~ 2.7 | - |
|
II. Public POCs for CVE-2026-111324
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-111324
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-111324 (1)
Proof of Concept for CVE-2026-111324 (1)
-
🔗 rustdesk-api/http/router/api.go at v2.7 · lejianwen/rustdesk-api · GitHub Read full article technical-description
Security Blog Posts for CVE-2026-111324 (1)
Other References for CVE-2026-111324 (2)
-
🔗 rustdesk-api/http/controller/api/peer.go at v2.7 · lejianwen/rustdesk-api · GitHub technical-description
-
IV. Related Vulnerabilities
Same weakness: CWE-639
-
CVE-2026-116018
ONEARMY community-platform before 2.165.2 IDOR via notificat -
CVE-2026-116017
Xiaozhi-esp32-server before 0.9.8 IDOR via device address-bo -
CVE-2026-116015
yudao-cloud through 2026.09 IDOR via after-sale-log list end -
CVE-2026-116010
RosarioSIS before 12.9.1 Missing Authorization in Teacher Sa -
CVE-2026-115998
IDOR: User reads and modifies findings from other people's p
V. Comments for CVE-2026-111324
No comments yet