Description
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Published: 2026-10-16
Score: 4.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized modification of asset contact passwords by an authenticated user with limited permissions
Action: Patch
AI Analysis

Impact

An authenticated user with general Edit rights but lacking Edit asset permission can send a crafted request to the partial‑save endpoint and change an asset contact password. This flaw enables the user to impersonate the asset contact or gain access as that contact, jeopardizing the confidentiality and integrity of the asset’s authentication credentials.

Affected Systems

The issue affects Devolutions Server up to and including version 2026.3.8.0. Any deployment of this product that has not been upgraded beyond that revision is vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves making a direct, crafted request to the partial‑save endpoint while authenticated with general Edit rights. No additional prerequisites are stated, so the exploit is feasible for users with the specified permissions.

Generated by OpenCVE AI on October 16, 2026 at 16:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Devolutions Server to a version later than 2026.3.8.0 that contains the access‑control fix.
  • Limit the use of general Edit permissions to users who also possess the Edit asset permission, and enforce least privilege for access to asset contact credentials.
  • Audit and monitor logs for unauthorized changes to asset contact passwords and enforce review of permission assignments.

Generated by OpenCVE AI on October 16, 2026 at 16:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 16 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Title Improper Access Control Allows Unauthorized Asset Contact Password Modification

Fri, 16 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Fri, 16 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Weaknesses CWE-863
References

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: DEVOLUTIONS

Published:

Updated: 2026-10-16T15:10:08.692Z

Reserved: 2026-10-13T19:35:53.329Z

Link: CVE-2026-110287

cve-icon Vulnrichment

Updated: 2026-10-16T15:10:00.803Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-16T14:17:22.020

Modified: 2026-10-16T15:38:04.947

Link: CVE-2026-110287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-16T16:45:14Z

Weaknesses