CVE-2026-102632: Devolutions PowerShell Universal vulnerability

Q: Who can exploit this issue?

An attacker must already be authenticated and have permission to create or update app tokens. They can then submit crafted app token requests to assign an arbitrary role, including administrator.

Q: Are single-node deployments affected by the revoked-token behavior?

The ability to reinstate a revoked app token is described specifically for multi-node deployments. The privilege-escalation issue through arbitrary role assignment applies to users with app token creation or update permissions.

Q: How can I identify potentially affected installations?

Installations running Devolutions PowerShell Universal 2026.3.4 or earlier are affected. Review which authenticated users have app token creation or update permissions, and in multi-node environments investigate revoked tokens that may have been reinstated.

Published Nov 13, 2026

Updated

Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.

Affected Software

1 affected component

Devolutions PowerShell Universal<=2026.3.4

Event History

Nov 13, 2026

CVE Published

via NVD·10:17 PM

Data Sourced

via NVD·10:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must already be authenticated and have permission to create or update app tokens. They can then submit crafted app token requests to assign an arbitrary role, including administrator.

Are single-node deployments affected by the revoked-token behavior?

The ability to reinstate a revoked app token is described specifically for multi-node deployments. The privilege-escalation issue through arbitrary role assignment applies to users with app token creation or update permissions.

How can I identify potentially affected installations?

Installations running Devolutions PowerShell Universal 2026.3.4 or earlier are affected. Review which authenticated users have app token creation or update permissions, and in multi-node environments investigate revoked tokens that may have been reinstated.

CVE-2026-102632: Devolutions PowerShell Universal vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are single-node deployments affected by the revoked-token behavior?

How can I identify potentially affected installations?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are single-node deployments affected by the revoked-token behavior?

How can I identify potentially affected installations?