CVE-2026-23572

Improper Access Control in TeamViewer clients

State: Published
Severity: 7.2 High
Published: Feb 5, 2026
Updated: Feb 5, 2026
Reserved: Jan 14, 2026

Description

Improper access control in the TeamViewer Full and Host clients (Windows, macOS, Linux) prior version 15.74.5 allows an authenticated user to bypass additional access controls with “Allow after confirmation” configuration in a remote session. An exploit could result in unauthorized access prior to local confirmation. The user needs to be authenticated for the remote session via ID/password, Session Link, or Easy Access as a prerequisite to exploit this vulnerability.

Scores

CVSS	Score	Vector	Source
3.1	7.2 High	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	TV

Weaknesses

CWE-863 Incorrect Authorization

Affected Products

Product	Versions
RemoteTeamViewer	before 15.74.5Affected
TensorTeamViewer	before 15.74.5Affected
OneTeamViewer	before 15.74.5Affected

References

https://www.teamviewer.com/en/resources/trust-center/security-bulletins/tv-2026-1003/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.