CVE-2026-3130

Authenticated Users Can Delete Checked‑Out PAM Accounts via Bulk Delete

View on CVE.org
Published Mar 3, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Description
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.

Analysis

AI-generated

Technical impact

An authenticated user with delete permission can delete a PAM account that is currently checked out by combining it with at least one non‑checked‑out account in a bulk delete operation. This flaw permits unauthorized account removal, compromising the integrity of user access and potentially disrupting active sessions. The weakness arises from improper enforcement of behavioral controls, classified as CWE-841.

Affected Systems

Devolutions Server, version 2025.3.15 and earlier. The vulnerability affects all deployments of Devolutions Server running the specified releases, regardless of deployment size or configuration.

Risk and Exploitability

The flaw carries a CVSS 9.8 score and a very low EPSS (<1%), indicating a critical severity but a low probability of public exploitation. It is not listed in the CISA KEV catalog. The attacker must be authenticated and possess delete rights, but once those conditions are met, the vulnerability is trivial to exploit by initiating a bulk deletion that targets a checked‑out account. The impact is the unintended loss of critical PAM accounts and potential service disruption.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to the latest Devolutions Server version that is newer than 2025.3.15.
  • Revoke delete privileges from users who should not delete PAM accounts, limiting the permission to administrators only.
  • Disable or restrict the bulk delete functionality for checked‑out accounts through configuration or policy.

Generated by OpenCVE AI on April 17, 2026 at 13:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Title Authenticated Users Can Delete Checked‑Out PAM Accounts via Bulk Delete
Type Values Removed Values Added
First Time appeared Devolutions devolutions Server
CPEs cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
Vendors & Products Devolutions devolutions Server
Type Values Removed Values Added
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Devolutions
Devolutions server
Vendors & Products Devolutions
Devolutions server
Type Values Removed Values Added
Description Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
Weaknesses CWE-841
References
Weaknesses
  • CWE-841

    Improper Enforcement of Behavioral Workflow

Sources

Status
PUBLISHED
Assigner
DEVOLUTIONS
Published
Updated
Mar 4, 2026, 2:45 PM
Reserved
Feb 24, 2026, 4:52 PM

View source JSON

Updated
Mar 4, 2026, 2:45 PM

JSON

Status
Analyzed
Published
Mar 3, 2026, 10:16 PM
Modified
Jun 17, 2026, 10:43 AM

View source JSON

No data.

Updated
Apr 17, 2026, 1:30 PM

JSON