Product:
TeamViewer
Summary
Improper access control in the TeamViewer Full and Host clients for Windows, macOS, and Linux prior to version 15.74.5 allows an authenticated user to bypass additional access controls with the Allow after confirmation configuration in a remote session. An exploit could result in unauthorized access prior to local confirmation. The user must be authenticated for the remote session via ID/password, Session Link, or Easy Access to exploit this vulnerability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.2 | CVE-2026-23572 |
Exploitation
To exploit this vulnerability, an attacker must first authenticate to the remote session using valid credentials. Once authenticated, the attacker can bypass the additional access controls that require local confirmation, allowing them to gain unauthorized access to the remote system.
Affected Products
- TeamViewer Full Client: Allows users to connect to remote devices but is vulnerable to unauthorized access due to improper access control.
- TeamViewer Host Client: Designed for unattended access to devices, it also suffers from the same access control issues.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest version of TeamViewer, which addresses the improper access control issue. Additionally, users should review their access control settings and ensure that only trusted individuals have access to remote sessions.