A broken access\ncontrol vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not\ncorrectly enforce authorization checks, allowing an authenticated user with low\nprivileges to perform actions and access resources intended only for higher‑privileged roles. An attacker with\nlow‑privileged credentials may exploit\nthis to gain unauthorized access to administrative or sensitive functionality.
"}],"value":"A broken access\ncontrol vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not\ncorrectly enforce authorization checks, allowing an authenticated user with low\nprivileges to perform actions and access resources intended only for higher‑privileged roles. An attacker with\nlow‑privileged credentials may exploit\nthis to gain unauthorized access to administrative or sensitive functionality."}],"impacts":[{"capecId":"CAPEC-122","descriptions":[{"lang":"en","value":"CAPEC-122 Privilege Abuse"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 – Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-05-22T08:29:16.451Z","orgId":"13430f76-86eb-43b2-a71c-82c956ef31b6","shortName":"TV"},"references":[{"url":"https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1005/"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Update to the\nlatest version (9.2 or the latest version available).
"}],"value":"Update to the\nlatest version (9.2 or the latest version available)."}],"source":{"discovery":"UNKNOWN"},"title":"Broken Access Control in TeamViewer DEX Platform (On Premises)","x_generator":{"engine":"Vulnogram 1.0.2"}}},"cveMetadata":{"assignerOrgId":"13430f76-86eb-43b2-a71c-82c956ef31b6","assignerShortName":"TV","cveId":"CVE-2026-8381","datePublished":"2026-05-22T08:29:16.451Z","dateReserved":"2026-05-12T08:47:56.307Z","dateUpdated":"2026-05-22T13:45:33.655Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-05-22 09:16:32","lastModifiedDate":"2026-05-22 09:16:32","problem_types":["CWE-862","CWE-862 CWE-862 – Missing Authorization"],"metrics":{"cvssMetricV31":[{"source":"psirt@teamviewer.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":5.4,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.5}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"8381","Ordinal":"1","Title":"Broken Access Control in TeamViewer DEX Platform (On Premises)","CVE":"CVE-2026-8381","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"8381","Ordinal":"1","NoteData":"A broken access\ncontrol vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2. Certain backend API endpoints do not\ncorrectly enforce authorization checks, allowing an authenticated user with low\nprivileges to perform actions and access resources intended only for higher‑privileged roles. An attacker with\nlow‑privileged credentials may exploit\nthis to gain unauthorized access to administrative or sensitive functionality.","Type":"Description","Title":"Broken Access Control in TeamViewer DEX Platform (On Premises)"}]}}}