Improper Access Control Vulnerability in Devolutions Server by Devolutions

CVE-2026-126326

What is CVE-2026-126326?

An improper access control issue exists in the administrative role assignment endpoint of Devolutions Server. This vulnerability allows an authenticated user with limited vault assignment management rights to escalate their privileges unauthorizedly. By crafting a specific role assignment request, the user can gain access to sensitive vault entry passwords, potentially compromising the security of the application.

References