TeamViewer Full and Host Clients Improper Access Control Vulnerability

A vulnerability allowing authenticated users to bypass access controls in TeamViewer Full and Host clients on Windows, macOS, and Linux, prior to version 15.74.5, has been identified. This issue arises from improper access control, which allows users to exploit the 'Allow after confirmation' setting in remote sessions, potentially leading to unauthorized access before local confirmation. To exploit this vulnerability, users must be authenticated for the remote session via ID/password, Session Link, or Easy Access.

Impact

Exploitation of this vulnerability could result in unauthorized access during remote sessions, bypassing local confirmation requirements.

Remediation

Users are advised to update to TeamViewer version 15.74.5 or the latest available version. If an immediate update is not possible, the 'Control this computer – Allow after Confirmation' access control setting can be applied as a temporary mitigation.