CVE-2026-10787: Medium severity Devolutions Devolutions Server vulnerability
Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request.
This issue affects :
Devolutions Server 2026.2.4.0 Devolutions Server 2026.1.20.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict access to the deleted user groups API endpoint to trusted IP ranges or internal management networks using firewall, WAF, or ACL rules; deny access from external/untrusted sources until a vendor patch is available and applied.
- Operational
Audit Devolutions Server logs for suspicious or crafted API requests targeting deleted user groups endpoints, investigate any observed access or data enumeration, and follow incident response procedures (including rotating credentials if exposure is suspected).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10787?
CVE-2026-10787 has a medium severity score of 4.3 according to the CVSS 3.1 standard.
What is CVE-2026-10787 about?
CVE-2026-10787 involves missing authorization in the deleted user groups API of Devolutions Server, allowing low-privileged users to enumerate metadata of deleted user groups.
How do I fix CVE-2026-10787?
To fix CVE-2026-10787, upgrade to Devolutions Server version 2026.2.4.1 or later, where the vulnerability is addressed.
Which versions of Devolutions Server are affected by CVE-2026-10787?
CVE-2026-10787 affects Devolutions Server version 2026.2.4.0 and earlier, including version 2026.1.20.0.
What impact does CVE-2026-10787 have?
CVE-2026-10787 allows authenticated low-privileged users to access and enumerate sensitive metadata of deleted user groups, potentially compromising data privacy.