Authorization Bypass Vulnerability in RustDesk API

CVE-2026-111324

What is CVE-2026-111324?

The RustDesk API, specifically versions up to 2.7, contains an authorization bypass vulnerability that permits unauthenticated attackers to overwrite sensitive peer records. By sending a specially crafted POST request to the /api/sysinfo endpoint with only the target device ID, attackers can manipulate critical information including hostname, username, OS, and UUID without any verification process for the UUID. This flaw allows them to subsequently log in and bind the modified peer record to their account, thus facilitating unauthorized access and control.

References