Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.9

RustDesk before 1.4.9 Allows Unauthorized Access

CVE-2026-57850 · published 3 months ago
Summary

A security issue in RustDesk before version 1.4.9 allows an authenticated user to access features they shouldn't be able to, like controlling the host's camera or transferring files, even if they're only supposed to have limited permissions. This could potentially allow unauthorized access to sensitive information or actions. To fix this, update RustDesk to version 1.4.9 or later.

What to do
  • Update rustdesk rustdesk to version 1.4.9 or later.
Affected software
VendorProductAffected versions
rustdesk rustdesk < 1.4.9
Original advisory text
RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection
RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, PortForward, ViewCamera, or Terminal) can send control messages and login options reserved for a full Remote session. An authenticated remote peer can exploit this missing scope check to act outside its granted scope, injecting out-of-scope control messages to observe and control the host beyond the permissions it was given.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.9 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published10 Jul 2026
Updated4 Nov 2026
First seen10 Jul 2026
Sources
CVE-2026-57850 · OSV
CVE-2026-57850 · NVD
CVE-2026-57850 · MITRE
Track software like this
Free during beta