The TeamViewer DEX Platform (On‑Premises) contains a broken access control flaw that allows a user who is authenticated with low privileges to access backend API endpoints that are intended for higher‑privileged roles. As a result, an attacker could gain unauthorized access to administrative operations or sensitive data, potentially compromising the integrity and confidentiality of the system. The weakness is classified as CWE‑862 – Broken Access Control.

Any installation of the TeamViewer DEX Platform that uses a version earlier than 9.2 is affected. The issue is relevant to the on‑premises deployment of the platform, where the backend APIs are exposed to authenticated users. No later versions, such as 9.2 or newer, contain the fix.

The CVSS score is 5.4, indicating moderate severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker would need valid credentials for a low‑privilege account and the ability to send requests to the affected API endpoints. The vulnerable endpoints do not enforce proper authorization checks, allowing the attacker to elevate privileges and access sensitive resources.