CVE-2026-111324: Authorization Bypass Through User-Controlled Key in lejianwen rustdesk-api

CVE-2026-111324 describes an authorization bypass vulnerability in lejianwen's rustdesk-api up to version 2.7. The flaw allows unauthenticated attackers to overwrite existing peer records by providing only a target device ID to the POST /api/sysinfo endpoint. The vulnerability arises because the API does not verify the uuid when updating peer information, enabling attackers to change critical fields such as hostname, username, OS, and uuid. Subsequently, attackers can authenticate by presenting the manipulated uuid, effectively rebinding the peer to their account without proper authorization.

An attacker can overwrite peer records without authentication, potentially hijacking device identities and rebinding them to their own accounts. This could lead to unauthorized access and manipulation of peer devices within the rustdesk-api environment. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating a significant but not critical risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the POST /api/sysinfo endpoint and monitor for suspicious activity involving device ID submissions. Avoid exposing the API to untrusted networks.