CVE-2026-126326: Security vulnerability
Published Nov 11, 2026
·Updated
Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.
Event History
Nov 11, 2026
CVE Published
via MITRE·09:25 PM
Data Sourced
via MITRE·09:25 PM
DescriptionWeakness
Data Sourced
via NVD·10:17 PM
DescriptionWeakness
Frequently Asked Questions
1
Which users are realistically positioned to exploit this issue?
An attacker must already be authenticated and have vault assignment management rights. The issue enables that user to escalate privileges beyond those assigned rights.
2
What access could an attacker gain through successful exploitation?
A successful crafted role assignment request can allow the attacker to read vault entry passwords.
3
Which Devolutions Server versions are affected?
Devolutions Server 2026.3.13.0 and earlier are affected.