{"id":"CVE-2026-111324","summary":"rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo","details":"rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.","modified":"2026-10-21T10:31:00.848408242Z","published":"2026-10-15T21:43:32.384Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111324.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-639"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111324.json"},{"type":"ADVISORY","url":"https://hackmd.io/@hieuPenguinnn/rustdesk-api-sysinfo-unauth-peer-tamper"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111324"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/rustdesk-api-through-2.7-authorization-bypass-via-post-api-sysinfo"},{"type":"PACKAGE","url":"https://github.com/lejianwen/rustdesk-api"},{"type":"ARTICLE","url":"https://github.com/lejianwen/rustdesk-api/blob/v2.7/http/controller/api/peer.go#L26-L57"},{"type":"ARTICLE","url":"https://github.com/lejianwen/rustdesk-api/blob/v2.7/http/router/api.go#L60-L76"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/lejianwen/rustdesk-api","events":[{"introduced":"0"},{"last_affected":"222792419f8b55c17b36bf5f423ec5ed7a53e2c4"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0"},{"last_affected":"2.7"}]},{"range":[{"introduced":"0"},{"last_affected":"2.7"}],"source":"DESCRIPTION"}]}}],"versions":["v2.7","v1.2.0","v1.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111324.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}]}