CVE-2026-90969 in Server
Summary
by MITRE • 09/15/2026
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified as Improper Access Control within Devolutions Server versions 2026.2.16 and prior represents a critical flaw in the application's authorization logic, specifically targeting the vault entry listing functionality. This issue stems from an insufficient verification of user permissions when processing requests to retrieve metadata about stored credentials. While the system correctly enforces access controls for individual password retrieval operations, it fails to apply equivalent restrictions at the bulk data level through the entry listing endpoint. Consequently, authenticated users who have been explicitly denied the view-password permission can still bypass these security boundaries by interacting with specific API parameters designed to disclose credential details during list generation.
From a technical perspective, the flaw resides in how the backend service processes query parameters associated with password disclosure within the listing request. The application logic appears to prioritize data retrieval efficiency over strict authorization checks for sensitive fields when generating lists of vault entries. By including specific flags or parameters that signal an intent to include passwords in the response payload, the server bypasses the standard permission gatekeepers that would normally block such access. This allows any authenticated user with at least basic read access to the vault structure to extract plaintext credentials without triggering a forbidden error or being denied service. The mechanism relies on the assumption that list endpoints are inherently safe for general users, ignoring the sensitive nature of the data fields requested via these specific parameters.
The operational impact of this vulnerability is severe, as it effectively nullifies the principle of least privilege implemented within the Devolutions Server environment. Organizations relying on granular access controls to segment administrative duties or restrict developer visibility into production secrets find their security posture compromised. An attacker with low-level authenticated credentials can harvest a comprehensive list of all stored passwords in plaintext format. This facilitates further attacks such as lateral movement across network segments, privilege escalation by compromising higher-privileged accounts found within the vault, and potential data exfiltration if combined with other vulnerabilities or misconfigurations that allow external transmission of this harvested data. The exposure is not limited to immediate credential theft but also aids in reconnaissance for more sophisticated intrusion campaigns.
This vulnerability aligns closely with CWE-269, which classifies Improper Privilege Management, and specifically relates to the failure to enforce proper access control on API endpoints. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1078, Valid Accounts, where an adversary uses legitimate credentials to gain unauthorized access to sensitive information. It also touches upon data exposure principles found in CWE-200, Information Exposure, as the system inadvertently reveals confidential authentication material through a seemingly benign administrative function. The root cause is typically attributed to inconsistent implementation of authorization checks across different API methods within the same module, where bulk retrieval operations are not subjected to the same rigorous validation as single-item retrievals.
Mitigation strategies must focus on immediate patching and architectural review. Administrators should upgrade Devolutions Server to version 2026.2.17 or later, where this authorization logic has been corrected to enforce password-view permissions consistently across all endpoints that return credential data. Until the update is applied, network-level controls such as Web Application Firewalls can be configured to inspect API requests for specific parameters associated with password disclosure in listing calls and block them if they originate from users lacking elevated privileges. Additionally, organizations should audit their existing access control policies within Devolutions Server to ensure that no unnecessary broad read permissions are granted to low-privileged accounts. Implementing strict logging and monitoring for unusual patterns of vault entry listings can also help detect potential exploitation attempts in real-time while longer-term remediation efforts are underway.