CVE-2026-111324 in rustdesk-api
Summary
by MITRE • 10/16/2026
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified in RustDesk API versions through 2.7 represents a critical authorization bypass flaw within the remote desktop management infrastructure. This security defect resides specifically in the POST /api/sysinfo endpoint, which is designed to update system information for connected peers. The core technical failure lies in the server-side validation logic, where the application fails to enforce strict ownership verification when processing updates to peer records. Specifically, an attacker can supply only a target device ID without providing valid authentication credentials or proof of ownership via UUID verification. This lack of input sanitization and access control allows unauthenticated actors to manipulate critical identity attributes associated with remote devices, including hostname, username, operating system details, and the universally unique identifier (UUID).
From a technical perspective, this flaw constitutes an insecure direct object reference combined with broken access controls. The API endpoint accepts modifications to peer metadata but does not cross-reference these changes against existing session tokens or ownership records before committing them to the database. By overwriting the UUID field of a target device record, an attacker effectively severs the link between the physical hardware and its legitimate owner's account. This manipulation is significant because the UUID serves as the primary key for authenticating and binding devices in many remote access architectures. Once the UUID has been overwritten with one controlled by the attacker, subsequent login attempts using that manipulated identifier allow the adversary to claim ownership of the device without needing prior credentials or multi-factor authentication steps intended to verify identity.
The operational impact of this vulnerability is severe, enabling full account takeover and unauthorized control over remote systems. An attacker who exploits this flaw can rebind a victim's peer device to their own RustDesk account. This results in the complete loss of confidentiality and integrity for the affected system. The legitimate user may be locked out or find that their access controls have been bypassed, while the attacker gains persistent administrative-level access to view screens, transfer files, execute commands, and potentially pivot into internal networks depending on the victim's network topology. This scenario is particularly dangerous in enterprise environments where RustDesk might be used for IT support or remote work infrastructure, as it allows a single compromised API interaction to lead to widespread lateral movement and data exfiltration capabilities.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically the failure to verify identity before granting access or modifying resources. It also maps closely to CWE-639, Authorization Bypass Through User-Controlled Key, as the attacker uses a controlled key (the target device ID) to bypass authorization checks for updating sensitive fields like UUID. In terms of offensive security frameworks, this exploit technique corresponds to MITRE ATT&CK T1078, Valid Accounts, where an adversary gains access using legitimate credentials that have been compromised or manipulated through account takeover techniques such as those described in T1098, Account Manipulation. The ability to rebind devices effectively hijacks the trust relationship between the client software and the central relay server.
Mitigation strategies must focus on immediate patching and architectural hardening. Organizations running RustDesk API versions prior to 2.7 should upgrade to the latest stable release where this authorization check has been corrected. For environments that cannot immediately update, network-level controls such as Web Application Firewalls (WAF) can be configured to restrict access to the /api/sysinfo endpoint based on IP reputation or require additional authentication headers if not already enforced by default configurations. Administrators should also audit existing peer records for anomalies in UUID ownership and ensure that multi-factor authentication is enabled for all user accounts associated with remote desktop services. Regular security assessments focusing on API endpoints are recommended to detect similar logic flaws where object identifiers are used without sufficient validation against session context or ownership metadata.