---
id: "CVE-2026-102632"
page: "https://infrastack.ai/live/CVE-2026-102632"
kind: "vulnerability"
aliases: ["CVE-2026-102632"]
title: "PowerShell Universal: app token flaw lets users gain administrator rights"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "powershell-universal", "self-hosted", "windows"]
not_affected_if: ["newer-version", "no-token-permission-users"]
published_at: "2026-11-13T22:17:19+00:00"
first_seen_at: "2026-11-13T22:33:33+00:00"
updated_at: "2026-11-13T22:34:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-102632", "first_seen_at": "2026-11-13T22:33:33+00:00"}]
exploit_sources: []
---

# PowerShell Universal: app token flaw lets users gain administrator rights

Link for people: https://infrastack.ai/live/CVE-2026-102632 (this .md is for agents)

Devolutions PowerShell Universal 2026.3.4 and earlier let an authenticated user with token create or update permission assign themselves any role, including administrator. In multi-node deployments, a revoked app token can also be reinstated.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed PowerShell Universal version in the admin console or on the server with the product's own tooling; compare against `2026.3.4`.
- Review who holds token create or update permissions in the app token settings.

## Fix

- Move to a PowerShell Universal release later than `2026.3.4`; the sources do not name the exact fixed version.

## Timeline

- 2026-11-13T22:33:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-102632

## From the sources

Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_