CVE-2026-110287 in Server
Summary
by MITRE • 10/16/2026
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The vulnerability identified as Improper Access Control within Devolutions Server versions 2026.3.8.0 and prior represents a critical flaw in the application's authorization logic, specifically concerning the management of asset contact credentials. This issue stems from an inconsistency between the user interface permissions displayed to authenticated users and the actual enforcement mechanisms applied at the backend API level. While the system correctly restricts certain high-level actions based on granular role-based access control policies, it fails to validate these same permissions when processing requests directed at specific partial-update endpoints used for saving asset metadata.
Technically, the flaw resides in the handling of the partial-save endpoint, which is designed to allow users to update individual fields within an asset record without requiring a full object replacement. The server-side logic checks whether the authenticated user possesses general Edit permissions for assets but neglects to verify if they hold the specific permission required to edit the contact password field itself. This oversight allows any user with basic editing privileges, even those explicitly denied access to modify sensitive credential data such as passwords or secrets, to bypass these restrictions by crafting a direct HTTP request that targets this endpoint and includes modified contact information in the payload.
The operational impact of this vulnerability is significant because it enables privilege escalation at the application level without requiring additional authentication factors or exploitation of separate software bugs. An attacker with low-level access can effectively elevate their capabilities to manage sensitive credentials for assets they are not authorized to control. This breach undermines the principle of least privilege, potentially leading to unauthorized changes in password policies, exposure of shared secrets if retrieved through other means, or disruption of service by altering critical contact information associated with managed infrastructure components.
From a classification perspective, this vulnerability aligns directly with CWE-269, which denotes Improper Privilege Management, as the application fails to enforce appropriate access control levels for specific functions. It also maps closely to ATT&CK technique T1078, Valid Accounts, where an adversary uses legitimate credentials that have been granted insufficiently restricted permissions to perform unauthorized actions within a system environment. The lack of server-side validation against fine-grained permission sets creates a gap that can be reliably exploited through automated scripting tools or manual request manipulation using standard web proxies.
Mitigation strategies must prioritize immediate patching to the latest stable version of Devolutions Server where this authorization check has been corrected in the backend logic. Until an update is applied, administrators should implement network-level controls such as Web Application Firewalls that can inspect and block requests targeting the partial-save endpoint if they originate from users lacking specific credential modification rights. Additionally, reviewing audit logs for unusual patterns of access to asset contact fields by low-privilege accounts can help detect ongoing exploitation attempts while reinforcing monitoring protocols around sensitive configuration changes.