RustDesk versions prior to 1.4.9 contain a vulnerability where the server does not enforce the authorized connection scope of a session. This allows a peer with a limited session type (such as FileTransfer, PortForward, ViewCamera, or Terminal) to send control messages and login options intended only for full Remote sessions. An authenticated remote peer can exploit this flaw to perform actions beyond their granted permissions, potentially observing and controlling the host system.