CVE-2026-16799 in PowerShell Universal
Summary
by MITRE • 07/24/2026
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a critical improper access control flaw in Devolutions PowerShell Universal version 2026.2.2 and earlier, where authenticated users with minimal privileges can escalate their capabilities through inadequate server-side authorization mechanisms. The issue specifically affects the automation tests and workflows features, which are core components of the platform's operational framework. The vulnerability stems from missing authorization checks that should validate user permissions before allowing execution of sensitive operations or modification of workflow properties.
The technical implementation flaw occurs when the application fails to enforce proper access control validation at the server level during automation test execution and workflow property modifications. Even though users possess only the Reader role, which typically restricts access to read-only operations, the absence of server-side authorization checks allows these users to bypass expected permission boundaries. This represents a classic violation of the principle of least privilege and demonstrates a failure in the application's security architecture.
From an operational impact perspective, this vulnerability creates significant risks for organizations using PowerShell Universal, as it enables authenticated attackers with minimal privileges to potentially disrupt critical automation processes, modify workflow configurations that could affect system integrity, or execute unauthorized tests that might reveal sensitive information. The ability to modify workflow properties can lead to service interruptions, data manipulation, or the introduction of malicious execution paths within the automation framework.
The vulnerability aligns with CWE-285, which addresses improper authorization issues in software applications, and maps to ATT&CK technique T1078 for valid accounts and privilege escalation. Organizations should immediately implement mitigations including applying the latest patches from Devolutions, implementing additional monitoring of automation test execution, and reviewing user role assignments to ensure that only authorized personnel have access to workflow modification capabilities. Network segmentation and least-privilege access controls should be enforced to limit potential exploitation impact.
The root cause analysis reveals that the application's authorization model fails to properly validate whether users with Reader roles should be permitted to execute automation tests or modify workflow properties, indicating a fundamental flaw in the security design. This oversight allows privilege escalation through indirect means, as the attacker can leverage their authenticated session to perform actions beyond their assigned permissions. The vulnerability demonstrates the critical importance of server-side validation and the necessity of implementing comprehensive access control mechanisms throughout all application features.
Organizations should conduct immediate security assessments of their PowerShell Universal deployments to identify affected systems and implement temporary compensating controls such as disabling automation test execution for users with Reader roles or implementing additional audit logging to detect unauthorized workflow modifications. The vulnerability highlights the need for continuous security testing and proper authorization validation in enterprise automation platforms, particularly those handling sensitive operational workflows and test executions that could impact production environments.