Questions about the critical ThinLinc security issue found on 04-08-2026

[Lucy_Z]

Hi all,

I just saw the urgent announcement about the security issue that has been found on Thinlinc servers on 04-08-2026:

Urgent: ThinLinc security issue

A critical security issue has been discovered in the ThinLinc server that allows any user to impersonate any other user, including the root user. This issue affects all versions of ThinLinc. Fixes for all supported versions of ThinLinc will be released at noon UTC 2026-04-22. Users running a version older than ThinLinc 4.15.0 should be prepared to not just apply the fix, but also to do an upgrade to a supported version. There are no known mitigations for this issue. Users should be prepared to…

Because that post does not allow replies, I am creating this thread here. I do thank ThinLinc for promptly letting us know about the issue, but because a patch is expected only 14 days from now, I am afraid we need more information than what was provided. For example:

1. what does “allows any user to impersonate any other user” mean exactly? Would the impersonator need to know the real user’s password or can they do so without that?

2. does that affect the security of our servers in what regards non-users? That is, can attackers that are not at all registered as users have access to our servers in any way due to this issue?

3. are there any measures that we can take in the meanwhile to mitigate risks?

Thanks for clarifying these topics!

[aaron]

Hi @Lucy_Z,

The issue relates to existing, authenticated users. So it is only users who are already able to authenticate successfully who would be able to impersonate others.

Unfortunately, in the interests of responsible disclosure, we’re unable to divulge much more information at present. The fix will be provided as a point release, so we wanted to give enough notice for people to schedule in a maintenance window for the upgrade.

Appreciate your understanding in all of this!

[wilsj]

Also note that the issue was discovered during a penetration test. We have not seen any indications of it being used by malicious actors in the wild.

[sswirski]

@aaron

So it is only users who are already able to authenticate successfully who would be able to impersonate others.

Okay, so that sounds like “if I trust my current users and their client machines have not been compromised (no credentials or 2FA tokens leaked), I have nothing to fear at the moment”?

[wilsj]

Okay, so that sounds like “if I trust my current users and their client machines have not been compromised (no credentials or 2FA tokens leaked), I have nothing to fear at the moment”?

Yes. That is correct.