CVE-2026-8381 — A broken access control vulnerability exists in the

title: CVE-2026-8381 - Unauthorized API Access via Broken Access Control
id: scw-2026-05-22-ai-1
status: experimental
level: high
description: |
  This rule detects attempts to access sensitive backend API endpoints (e.g., admin, settings, user elevation) using HTTP POST, PUT, or DELETE methods. This is specific to CVE-2026-8381, which involves broken access control in TeamViewer DEX Platform (On-Premises) allowing low-privileged users to access administrative functions. The presence of these URIs combined with modification methods suggests an attempt to exploit the vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-22
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8381/
tags:
  - attack.privilege_escalation
  - attack.t1078.002
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/api/v1/admin'
          - '/api/v1/settings'
          - '/api/v1/users/elevate'
      cs-method:
          - 'POST'
          - 'PUT'
          - 'DELETE'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse