{"id":"CVE-2026-102632","kind":"vulnerability","aliases":["CVE-2026-102632"],"related":[],"title":"PowerShell Universal: app token flaw lets users gain administrator rights","description":"Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.","summary":"Devolutions PowerShell Universal 2026.3.4 and earlier let an authenticated user with token create or update permission assign themselves any role, including administrator. In multi-node deployments, a revoked app token can also be reinstated.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","powershell-universal","self-hosted","windows"],"not_affected_if":["newer-version","no-token-permission-users"],"how_to_check":"- Check the installed PowerShell Universal version in the admin console or on the server with the product's own tooling; compare against `2026.3.4`.\n- Review who holds token create or update permissions in the app token settings.","fix":"- Move to a PowerShell Universal release later than `2026.3.4`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-13T22:17:19+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","triaged_at":"2026-11-13T22:34:49+00:00","updated_at":"2026-11-13T22:34:49+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-13T22:34:49Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a PowerShell Universal release later than `2026.3.4`; the sources do not name the exact fixed version.","reach":"network","title":"PowerShell Universal: app token flaw lets users gain administrator rights","impact":"high","summary":"Devolutions PowerShell Universal 2026.3.4 and earlier let an authenticated user with token create or update permission assign themselves any role, including administrator. In multi-node deployments, a revoked app token can also be reinstated.","audience":"businesses","category":"package","nicknames":[],"who_cares":["powershell-universal","self-hosted","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user becomes administrator and revoked tokens return","analyst_note":"Find the fixed version and vendor advisory for PowerShell Universal beyond 2026.3.4 and confirm whether the multi-node revocation issue has a separate fix.","how_to_check":"- Check the installed PowerShell Universal version in the admin console or on the server with the product's own tooling; compare against `2026.3.4`.\n- Review who holds token create or update permissions in the app token settings.\n- unknown for whether the sources give a configuration-based check.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-token-permission-users","newer-version"],"who_is_affected":"Teams that run Devolutions PowerShell Universal 2026.3.4 or earlier with accounts that can create or update app tokens are exposed. Multi-node deployments are also exposed to reinstatement of revoked tokens. Single-user or installations without token-permitted accounts have less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00077,"input_tokens":4566,"output_tokens":626,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-102632':13A,16A '-2026':12A,15A '2026.3.4':28B,73C 'administr':9A,46B,90C 'allow':76C,92C 'also':57B 'app':3A,54B,65C,95C,107C 'arbitrari':113C 'assign':41B,62C 'authent':33B,78C 'compon':68C 'craft':106C 'creat':37B 'creation':82C 'cve':11A,14A 'deploy':51B,104C 'devolut':25B,70C 'earlier':30B,75C 'escal':87C 'flaw':5A 'gain':8A 'host':23B 'includ':45B 'incorrect':60C 'let':6A,31B 'manag':67C 'multi':49B,102C 'multi-nod':48B,101C 'node':50B,103C 'packag':17B 'permiss':40B,85C 'powershel':1A,19B,26B,71C 'powershell-univers':18B 'privileg':61C,88C 'reinstat':59B,99C 'request':109C 'revoc':116C 'revok':53B,94C 'right':10A 'role':44B,114C 'self':22B 'self-host':21B 'set':111C 'state':117C 'token':4A,36B,55B,66C,81C,96C,108C 'univers':2A,20B,27B,72C 'updat':39B,84C 'user':7A,34B,79C 'via':105C 'window':24B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Devolutions PowerShell Universal 2026.3.4 or earlier with accounts that can create or update app tokens are exposed. Multi-node deployments are also exposed to reinstatement of revoked tokens. Single-user or installations without token-permitted accounts have less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","powershelluniversal","selfhosted","windows"],"campaign_type":null,"search_a":"'-102632':13A,16A '-2026':12A,15A 'administr':9A 'app':3A 'cve':11A,14A 'flaw':5A 'gain':8A 'let':6A 'powershel':1A 'right':10A 'token':4A 'univers':2A 'user':7A","search_b":"'2026.3.4':28B 'administr':46B 'also':57B 'app':54B 'assign':41B 'authent':33B 'creat':37B 'deploy':51B 'devolut':25B 'earlier':30B 'host':23B 'includ':45B 'let':31B 'multi':49B 'multi-nod':48B 'node':50B 'packag':17B 'permiss':40B 'powershel':19B,26B 'powershell-univers':18B 'reinstat':59B 'revok':53B 'role':44B 'self':22B 'self-host':21B 'token':36B,55B 'univers':20B,27B 'updat':39B 'user':34B 'window':24B","search_c":"'2026.3.4':73C 'administr':90C 'allow':76C,92C 'app':65C,95C,107C 'arbitrari':113C 'assign':62C 'authent':78C 'compon':68C 'craft':106C 'creation':82C 'deploy':104C 'devolut':70C 'earlier':75C 'escal':87C 'incorrect':60C 'manag':67C 'multi':102C 'multi-nod':101C 'node':103C 'permiss':85C 'powershel':71C 'privileg':61C,88C 'reinstat':99C 'request':109C 'revoc':116C 'revok':94C 'role':114C 'set':111C 'state':117C 'token':66C,81C,96C,108C 'univers':72C 'updat':84C 'user':79C 'via':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T22:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-102632","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102632","severity":null,"published_at":"2026-11-13T22:17:19+00:00","modified_at":"2026-11-13T22:17:19+00:00","first_seen_at":"2026-11-13T22:33:33+00:00","fetched_at":"2026-11-13T22:33:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}