CVE-2026-100289 in Server
Summary
by MITRE • 09/29/2026
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/29/2026
The vulnerability identified as missing authorization within the gateway network scan token API of Devolutions Server versions 2026.3.5.0 and earlier represents a critical flaw in access control mechanisms. This issue specifically affects authenticated users who possess low-privileged roles, such as standard viewers or basic contributors, rather than administrators. The core technical failure lies in the absence of proper role-based access control checks when processing requests to generate network scan tokens. Consequently, any user with valid credentials can interact with this specific API endpoint without being denied based on their insufficient privilege level. This design oversight allows malicious actors who have compromised low-level accounts or obtained legitimate credentials through phishing or credential stuffing attacks to bypass intended security boundaries and escalate their capabilities within the internal infrastructure.
From a technical perspective, the vulnerability enables an attacker to request the generation of tokens specifically designed for network scanning operations via the gateway interface. Once these tokens are issued, they can be utilized to perform active reconnaissance against other systems on the local or private network segments accessible by the Devolutions Server environment. This includes executing port scans and mapping out live hosts, effectively turning a password management vault into an internal pivot point for further attacks. The exploitation does not require complex payload construction beyond crafting valid API requests with appropriate authentication headers, making it highly exploitable even against defenders who employ basic security monitoring tools that do specifically flag unusual network scanning activity originating from application servers.
The operational impact of this vulnerability is significant as it facilitates unauthorized internal network discovery and port scanning. By leveraging the generated tokens, an attacker can map out the topology of the protected environment, identifying critical assets such as database servers, domain controllers, or other sensitive infrastructure components that were previously hidden behind firewalls or segmentation rules. This information gathering phase is often a precursor to more destructive attacks, including lateral movement, privilege escalation, and data exfiltration. The ability to perform these actions from an application server increases the attack surface significantly, as defenders may not expect network scanning activities originating from web-facing applications or internal management portals.
This vulnerability aligns with CWE-269, which describes Improper Privilege Assignment, where a user is granted privileges that exceed their intended role. Furthermore, it maps directly to MITRE ATT&CK technique T1046, Network Service Discovery, and potentially T1595, Active Scanning, as the attacker uses the compromised application functionality to probe network services for vulnerabilities or open ports. The exploitation path also relates to CWE-862, Missing Authorization, highlighting a fundamental failure in enforcing access control policies at the API level.
To mitigate this risk, organizations running affected versions of Devolutions Server should immediately apply vendor-provided patches that enforce strict role-based access controls on the network scan token generation endpoint. Until patching is possible, administrators can implement compensating controls such as restricting outbound traffic from the application server to only necessary destinations and monitoring for unusual API calls or high-frequency connection attempts indicative of port scanning. Additionally, enforcing multi-factor authentication for all user accounts reduces the likelihood of credential compromise that could lead to exploitation of this flaw. Regular audits of API endpoint permissions should be conducted to ensure that sensitive administrative functions are not accessible to low-privileged users in any future updates or configurations.