Description
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Published: 2026-10-16
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification of asset contact passwords by an authenticated user with limited permissions
Action: Patch
AI Analysis

Impact

An authenticated user with general Edit rights but lacking Edit asset permission can send a crafted request to the partial‑save endpoint and change an asset contact password. This flaw enables the user to impersonate the asset contact or gain access as that contact, jeopardizing the confidentiality and integrity of the asset’s authentication credentials.

Affected Systems

The issue affects Devolutions Server up to and including version 2026.3.8.0. Any deployment of this product that has not been upgraded beyond that revision is vulnerable.

Risk and Exploitability

The CVSS score of 4.3 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves making a direct, crafted request to the partial‑save endpoint while authenticated with general Edit rights. No additional prerequisites are stated, so the exploit is feasible for users with the specified permissions.

Generated by OpenCVE AI on October 16, 2026 at 18:04 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Devolutions Server to a version later than 2026.3.8.0 that contains the access‑control fix.
  • Limit the use of general Edit permissions to users who also possess the Edit asset permission, and enforce least privilege for access to asset contact credentials.
  • Audit and monitor logs for unauthorized changes to asset contact passwords and enforce review of permission assignments.

Generated by OpenCVE AI on October 16, 2026 at 18:04 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 18:45:00 +0000

Type Values Removed Values Added
First Time appeared Devolutions devolutions Server
CPEs cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
Vendors & Products Devolutions devolutions Server

Fri, 23 Oct 2026 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Devolutions
Devolutions server
Vendors & Products Devolutions
Devolutions server

Fri, 16 Oct 2026 17:00:00 +0000

Type Values Removed Values Added
Title Improper Access Control Allows Unauthorized Asset Contact Password Modification

Fri, 16 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}

Fri, 16 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Description Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Weaknesses CWE-863
References

Subscriptions

Devolutions Devolutions Server Server
cve-icon MITRE

Status: PUBLISHED

Assigner: DEVOLUTIONS

Published:

Updated: 2026-10-16T15:10:08.692Z

Reserved: 2026-10-13T19:35:53.329Z

Link: CVE-2026-110287

cve-icon Vulnrichment

Updated: 2026-10-16T15:10:00.803Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-16T14:17:22.020

Modified: 2026-10-23T18:32:44.550

Link: CVE-2026-110287

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T10:30:08Z

Weaknesses