CVE-2026-105488: Devolutions Devolutions Server vulnerability

Q: Which users can exploit this issue?

An authenticated user who has only the global vault view permission can modify and delete global contact and folder entries.

Q: Which assets are affected by unauthorized changes?

The issue affects global contact entries and global folder entries in the global vault.

Q: What versions are affected?

Devolutions Server 2026.3.7.0 and earlier are affected.

Published Oct 6, 2026

Updated

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

Affected Software

1 affected component

Devolutions Devolutions Server<=2026.3.7.0

Event History

Oct 6, 2026

CVE Published

via MITRE·06:20 PM

Data Sourced

via MITRE·06:20 PM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

An authenticated user who has only the global vault view permission can modify and delete global contact and folder entries.

Which assets are affected by unauthorized changes?

The issue affects global contact entries and global folder entries in the global vault.

What versions are affected?

Devolutions Server 2026.3.7.0 and earlier are affected.

CVE-2026-105488: Devolutions Devolutions Server vulnerability

Affected Software

Event History

Frequently Asked Questions

Which users can exploit this issue?

Which assets are affected by unauthorized changes?

What versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

Which assets are affected by unauthorized changes?

What versions are affected?