This vulnerability (CWE-602) in RustDesk Client affects versions through 1.4.8 and arises from client-side enforcement of security controls that should be enforced server-side. The affected components include src/rendezvous_mediator.Rs, src/hbbs_http/sync.Rs, and routines handling API sync loops and API-server configuration. Because security decisions are improperly enforced on the client, an attacker with limited privileges could abuse this to escalate privileges or bypass intended restrictions. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity.

The vulnerability allows privilege abuse by bypassing server-side security enforcement, potentially enabling an attacker with local access to gain unauthorized privileges or perform actions beyond their intended scope. However, the attack requires local access (AV:L) and low privileges (PR:L), and there is no indication of remote exploitation or user interaction required.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit local access to trusted users and monitor for unusual privilege escalation attempts related to RustDesk Client.