CVE-2026-10787

Currently unrated

Key Information:

Vendor: Devolutions
Status: Server
Vendor: CVE Published:; 8 June 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-10787?

Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request.

This issue affects :

Devolutions Server 2026.2.4.0
Devolutions Server 2026.1.20.0 and earlier

Affected Version(s)

Server 2026.2.4.0

Server 0 <= 2026.1.20.0

References

https://devolutions.net/security/advisories/DEVO-2026-0015/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 8, 2026
Vulnerability Reserved
Jun 3, 2026

CVE-2026-10787 Data

JSON