{"id":"CVE-2026-119744","kind":"vulnerability","aliases":["CVE-2026-119744"],"related":[],"title":"Cendio ThinLinc: web client flaw lets a logged-in user impersonate root","description":"Cendio ThinLinc contains an improper authentication vulnerability in its browser-based web client (tlwebaccess) that allows an authenticated attacker to impersonate any other user, including root, by exploiting flaws in multi-step authentication flows such as one-time passwords, login banners, or expired password prompts. Attackers can leverage this authentication bypass during the multi-step login process to gain unauthorized access to other user accounts, including administrative privileges, in versions from 4.1.0 through 4.20.0.","summary":"ThinLinc's browser-based web client (tlwebaccess) has an improper authentication flaw in its multi-step login flows such as one-time passwords, login banners and expired password prompts. An attacker who already has a valid account can switch to another user, including root, and gain administrative access.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cendio","package","remote-desktop","self-hosted","thinlinc"],"not_affected_if":["versions-outside-4.1.0-4.20.0","web-client-disabled"],"how_to_check":"- Check the installed ThinLinc version on the server; the sources say versions 4.1.0 through 4.20.0 are affected\n- Confirm whether the browser-based web client (tlwebaccess) is enabled on the server","fix":"- Move to a ThinLinc release newer than `4.20.0`; the sources do not name the exact fixed version","status":"open","published_at":"2026-11-05T15:17:20+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","triaged_at":"2026-11-05T15:40:45+00:00","updated_at":"2026-11-05T15:40:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T15:40:45Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a ThinLinc release newer than `4.20.0`; the sources do not name the exact fixed version","reach":"network","title":"Cendio ThinLinc: web client flaw lets a logged-in user impersonate root","impact":"high","summary":"ThinLinc's browser-based web client (tlwebaccess) has an improper authentication flaw in its multi-step login flows such as one-time passwords, login banners and expired password prompts. An attacker who already has a valid account can switch to another user, including root, and gain administrative access.","audience":"businesses","category":"package","nicknames":[],"who_cares":["thinlinc","cendio","self-hosted","remote-desktop"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker with a valid login takes over any account, including root.","analyst_note":"Confirm the fixed ThinLinc version and the vendor advisory; the only linked source is a VulnCheck third-party advisory and the NVD entry.","how_to_check":"- Check the installed ThinLinc version on the server; the sources say versions 4.1.0 through 4.20.0 are affected\n- Confirm whether the browser-based web client (tlwebaccess) is enabled on the server","plain_action":"","needs_analyst":true,"not_affected_if":["versions-outside-4.1.0-4.20.0","web-client-disabled"],"who_is_affected":"Organisations running Cendio ThinLinc versions 4.1.0 through 4.20.0 with the browser-based web client exposed to users. The flaw requires an authenticated account, so exposure depends on who holds valid logins on the server. Installations without the web client, or on versions outside that range, are not described as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000746,"input_tokens":4318,"output_tokens":628,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119744':16A,19A '-2026':15A,18A '4.1.0':155C '4.20.0':157C 'access':79B,144C 'account':68B,148C 'administr':78B,150C 'allow':96C 'alreadi':64B 'anoth':72B 'attack':62B,99C,128C 'authent':40B,85C,98C,114C,132C 'banner':56B,123C 'base':33B,91C 'browser':32B,90C 'browser-bas':31B,89C 'bypass':133C 'cendio':1A,20B,80C 'client':4A,35B,93C 'contain':82C 'cve':14A,17A 'desktop':24B 'expir':58B,125C 'exploit':108C 'flaw':5A,41B,109C 'flow':48B,115C 'gain':77B,142C 'host':27B 'imperson':12A,101C 'improp':39B,84C 'includ':74B,105C,149C 'let':6A 'leverag':130C 'log':9A 'logged-in':8A 'login':47B,55B,122C,139C 'multi':45B,112C,137C 'multi-step':44B,111C,136C 'one':52B,119C 'one-tim':51B,118C 'packag':21B 'password':54B,59B,121C,126C 'privileg':151C 'process':140C 'prompt':60B,127C 'remot':23B 'remote-desktop':22B 'root':13A,75B,106C 'self':26B 'self-host':25B 'step':46B,113C,138C 'switch':70B 'thinlinc':2A,28B,29B,81C 'time':53B,120C 'tlwebaccess':36B,94C 'unauthor':143C 'user':11A,73B,104C,147C 'valid':67B 'version':153C 'vulner':86C 'web':3A,34B,92C","nicknames":[],"mitigations":[],"who_affected":"Organisations running Cendio ThinLinc versions 4.1.0 through 4.20.0 with the browser-based web client exposed to users. The flaw requires an authenticated account, so exposure depends on who holds valid logins on the server. Installations without the web client, or on versions outside that range, are not described as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cendio","high","package","remotedesktop","selfhosted","thinlinc"],"campaign_type":null,"first_public_at":"2026-11-05T15:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119744","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119744","severity":null,"published_at":"2026-11-05T15:17:20+00:00","modified_at":"2026-11-05T15:17:20+00:00","first_seen_at":"2026-11-05T15:39:21+00:00","fetched_at":"2026-11-05T15:39:21+00:00","note":null}],"documents":[{"id":77223,"url":"https://www.vulncheck.com/advisories/cendio-thinlinc-improper-authentication-via-web-access","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}