CVE-2026-102632 · Package
NO FIX YET · SEE WHAT TO DO
Devolutions PowerShell Universal 2026.3.4 and earlier let an authenticated user with token create or update permission assign themselves any role, including administrator. In multi-node deployments, a revoked app token can also be reinstated.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run Devolutions PowerShell Universal 2026.3.4 or earlier with accounts that can create or update app tokens are exposed. Multi-node deployments are also exposed to reinstatement of revoked tokens. Single-user or installations without token-permitted accounts have less exposure.
Not affected if newer-version, no-token-permission-users
Who cares powershell-universal, self-hosted, windows
2026.3.4.2026.3.4; the sources do not name the exact fixed version.Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.