A flaw in RustDesk Client’s API sync loop and configuration handling allows an attacker to orphan an API channel, effectively ignoring all administrative commands and ACL policies sent from the server. This flaw enables privilege abuse by letting a compromised client bypass server‑enforced restrictions and carry out actions that would normally require higher privileges. The weakness is tied to the CWE-602 (Insecure Design) and CWE-841 (Unauthorized Modification of Permissions).

The vulnerability impacts RustDesk Client on Windows, macOS, Linux, iOS, Android, and WebClient platforms. All installations through version 1.4.5 are affected, regardless of the underlying operating system (including the various OS CPEs listed).

The CVSS score of 8.8 indicates a high severity, but the EPSS score of less than 1% reflects a very low exploitation probability at the time of analysis. The vulnerability is not currently listed in the CISA KEV catalog. Likely exploitation would occur via a remote attacker who gains control of a RustDesk session or injects a malicious API command, then initiates an orphaned channel that ignores server‑side controls. No publicly available exploit code is noted, so the practical risk hinges on the attack vector being remote and the attacker having the ability to send commands through the client.