CVE-2026-100287 in Server
Summary
by MITRE • 09/29/2026
Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as missing authorization within the attachment history API of Devolutions Server versions 2026.3.5.0 and prior represents a critical flaw in access control logic, specifically categorized under CWE-862: Missing Authorization. This defect allows an authenticated user with low privileges to perform state-changing operations on vault attachments that they should not have permission to modify or delete. The core technical issue lies in the server's failure to validate whether the requesting user possesses sufficient administrative rights or ownership of the specific resource before executing destructive actions such as permanent deletion or restoration from history. By exploiting this gap, an attacker can craft a malicious API request targeting the attachment endpoint without triggering any authorization checks, effectively bypassing the intended role-based access control mechanisms designed to protect sensitive vault data integrity and availability.
From an operational perspective, the impact of this vulnerability is severe due to its potential for data loss and disruption of service continuity. An authenticated low-privileged user can permanently delete attachments associated with other users or shared vaults, leading to irreversible loss of critical information stored within those files. Furthermore, the ability to restore deleted attachments from history could be abused by malicious insiders to reintroduce compromised or unauthorized content into a secure environment, thereby undermining trust in the integrity of the vault system. This capability also facilitates denial-of-service conditions for other users who rely on these attachments, as their data can be removed at will without detection until after the damage is done. The lack of proper audit trails tied to authorization decisions further complicates forensic analysis and incident response efforts following an exploitation event.
This vulnerability aligns with MITRE ATT&CK technique T1485: Data Destruction, where adversaries aim to disrupt availability by destroying data or impacting its integrity. It also reflects aspects of T1078: Valid Accounts, as the attacker leverages legitimate credentials obtained through phishing, credential stuffing, or other means to gain initial access before exploiting the privilege escalation inherent in this authorization flaw. The attack vector is remote and requires only valid authentication, making it particularly dangerous in environments where users may have varying levels of trust but insufficient oversight over their actions regarding shared resources.
To mitigate this risk, immediate action should be taken by upgrading Devolutions Server to version 2026.3.5.1 or later, which addresses the authorization checks within the attachment history API. In addition to patching, organizations should implement strict role-based access controls that ensure only administrators or designated owners can perform deletion and restoration operations on vault attachments. Regular audits of user permissions and activity logs are recommended to detect any unauthorized attempts at modification. Security teams should also enforce principle of least privilege across all application roles, ensuring that low-privileged users do not have write-access capabilities beyond their specific job requirements. Monitoring for anomalous API calls involving attachment endpoints can provide early warning indicators of exploitation attempts in real-time environments.