ThinLinc web access authentication flaw lets users impersonate others

Anyone logged in to this Linux remote access server can take over other accounts, even admin ones.

Summary

A flaw in the ThinLinc browser-based web client (tlwebaccess) lets a logged-in user impersonate any other user, including root, during multi-step login. Versions 4.1.0 through 4.20.0 are affected.

Affected when

Able to log in with a user account
Multi-step login such as one-time passwords, login banners or expired password prompts

What to do

Update to the security release for your version line (4.15.1 through 4.20.1). If you cannot upgrade now, disable the tlwebaccess service.

Update to at least the version for your product:

Cendio ThinLinc 4.15 4.15.1 or later
Cendio ThinLinc 4.16 4.16.1 or later
Cendio ThinLinc 4.17 4.17.1 or later
Cendio ThinLinc 4.18 4.18.1 or later
Cendio ThinLinc 4.19 4.19.1 or later
Cendio ThinLinc 4.20 4.20.1 or later

Can't update yet?

sudo systemctl disable --now tlwebaccess.service

Products and platforms

Linux
Cendio ThinLinc

CVE IDs

CVE-2026-119744 (opens in a new tab)

Sources

Advisory: community.thinlinc.com (opens in a new tab) · community.thinlinc.com (opens in a new tab)
Write-up: vulncheck.com (opens in a new tab)
CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 14:50 UTC

First seen 2026-11-09 16:40 UTC