Vulnerability · Published Oct 15, 2026 · Assigned by VulnCheck

CVE-2026-111324rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo

Medium 5.3

In plain English

A medium-severity authorization bypass via user-controlled key in rustdesk-api from lejianwen. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 64.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid verification, then log in presenting that uuid to rebind the peer to their account.

Affected products (as reported)

Vendor	Product	Versions
lejianwen	rustdesk-api	0 – through 2.7

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://hackmd.io/@hieuPenguinnn/rustdesk-api-sysinfo-unauth-peer-tamper third-party-advisory
https://github.com/lejianwen/rustdesk-api/blob/v2.7/http/router/api.go#L60-L76 technical-description
https://github.com/lejianwen/rustdesk-api/blob/v2.7/http/controller/api/peer.go#L26-L57 technical-description
https://github.com/lejianwen/rustdesk-api product
VulnCheck Advisory: rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo third-party-advisory