CVE-2026-12105: Medium severity Devolutions Devolutions Server vulnerability
Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the folder duplication feature or restrict permission to duplicate folders to administrators/trusted roles to prevent inherited permissions from exposing attachments.
Devolutions Server folder duplication = disabled or restricted to administrators - Configuration
If possible, configure duplicated folders to not inherit permissions from the source (or to reset to explicit permissions) so attachments are not exposed via inherited permissions.
Devolutions Server permission inheritance on duplicated folders = do not inherit - Compensating control
Apply role-based access control to limit which authenticated users can access attachments or perform folder operations; monitor and alert on folder duplication and unexpected attachment access until a vendor fix is available.
- Operational
Audit existing folders and attachments for instances of folder duplication and review/correct permissions on any duplicated folders so attachments are not accessible by unintended users.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12105?
The severity of CVE-2026-12105 is medium with a CVSS score of 6.5.
What does CVE-2026-12105 affect?
CVE-2026-12105 affects Devolutions Server versions 2026.2.5 and 2026.1.21.
What is the risk associated with CVE-2026-12105?
The risk associated with CVE-2026-12105 is rated at 38, indicating potential exploitation under certain conditions.
How can I fix CVE-2026-12105?
To fix CVE-2026-12105, update Devolutions Server to a patched version that resolves the improper access control issue.
What type of vulnerability is CVE-2026-12105?
CVE-2026-12105 is an improper access control vulnerability that allows unauthorized access to attachments.