CVE-2026-105488: High severity Devolutions Devolutions Server vulnerability
Published Oct 6, 2026
·Updated
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.
Affected Software
1 affected component
Devolutions Devolutions Server<=2026.3.7.0
Event History
Oct 6, 2026
CVE Published
via MITRE·06:20 PM
Data Sourced
via MITRE·06:20 PM
DescriptionWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users can exploit this issue?
An authenticated user who has only the global vault view permission can modify and delete global contact and folder entries.
2
Which assets are affected by unauthorized changes?
The issue affects global contact entries and global folder entries in the global vault.
3
What versions are affected?
Devolutions Server 2026.3.7.0 and earlier are affected.