Description
Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional access controls with “Allow after confirmation” configuration in a remote session. An exploit could result in unauthorized access prior to local confirmation. The user needs to be authenticated for the remote session via ID/password, Session Link, or Easy Access as a prerequisite to exploit this vulnerability.
Published: 2026-02-05
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Remote Access
Action: Immediate Patch
AI Analysis

Impact

An improper access control flaw in TeamViewer Full and Host clients allows an authenticated remote user to bypass the "Allow after confirmation" setting, enabling remote control before local confirmation. This results in unauthorized access and is classified as a CWE-863 weakness.

Affected Systems

TeamViewer Full and Host clients on Windows, macOS, and Linux before version 15.74.5, affecting the TeamViewer:One, TeamViewer:Remote, and TeamViewer:Tensor products.

Risk and Exploitability

The CVSS score of 7.2 signals a high severity vulnerability, while an EPSS score of less than 1% indicates a low probability of exploitation and the vulnerability is not listed in the KEV catalog. Exploitation requires an authenticated remote session established through ID/password, Session Link, or Easy Access. Once authenticated, the attacker can bypass local confirmation and gain remote control, making the risk significant for enabled remote sessions.

Generated by OpenCVE AI on April 17, 2026 at 23:01 UTC.

Remediation

Vendor Solution

Update to the latest client version (15.74.5 or the latest version available).

Vendor Workaround

If an immediate update of the client is not possible and the use of additional access controls is required, the access control setting “Control this computer – Allow after Confirmation” can be set as mitigation. This prevents exploitation. The access controls can be configured in the Client Settings – “Advanced Options > Advanced Settings for connections to this computer” or via Policies “Access Control (incoming connections)”.

OpenCVE Recommended Actions

  • Upgrade TeamViewer clients to version 15.74.5 or later.
  • If an immediate update is not possible, enable the "Control this computer – Allow after Confirmation" setting to enforce local confirmation before remote control.
  • Configure additional access controls through Client Settings under Advanced Options or apply Policies for incoming connections to minimize exposure.

Generated by OpenCVE AI on April 17, 2026 at 23:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
First Time appeared Teamviewer
Teamviewer full Client
Teamviewer host
Teamviewer teamviewer
Vendors & Products Teamviewer
Teamviewer full Client
Teamviewer host
Teamviewer teamviewer

Thu, 05 Feb 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 05 Feb 2026 12:00:00 +0000

Type Values Removed Values Added
Description Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional access controls with “Allow after confirmation” configuration in a remote session. An exploit could result in unauthorized access prior to local confirmation. The user needs to be authenticated for the remote session via ID/password, Session Link, or Easy Access as a prerequisite to exploit this vulnerability.
Title Improper Access Control in TeamViewer clients
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Teamviewer Full Client Host Teamviewer
cve-icon MITRE

Status: PUBLISHED

Assigner: TV

Published:

Updated: 2026-02-05T14:11:05.910Z

Reserved: 2026-01-14T13:54:40.322Z

Link: CVE-2026-23572

cve-icon Vulnrichment

Updated: 2026-02-05T14:11:00.715Z

cve-icon NVD

Status : Deferred

Published: 2026-02-05T12:16:01.607

Modified: 2026-04-15T00:35:42.020

Link: CVE-2026-23572

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-17T23:15:30Z

Weaknesses