Live › vulnerability › CVE-2026-110287
Go to dashboardDevolutions Server has an access control flaw in the asset contact password field. A user with general Edit rights but without asset Edit permission can change that password by sending a crafted request to the partial-save endpoint.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only Devolutions Server installations on the affected version ranges are exposed, and the attacker must already hold a valid account with general Edit rights. Installations where users with general Edit also hold asset Edit permission, or where the vendor's fixed versions are already running, are not meaningfully exposed to this specific flaw.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| devolutions server | vendor | < 2026.2.20.0 | 2026.2.20.0 |
| devolutions server | vendor | >= 2026.3.5.0, < 2026.3.10.0 | 2026.3.10.0 |
2026.2.20.0, or from 2026.3.5.0 up to but not including 2026.3.10.0.2026.2.20.0 if on the older branch, or to 2026.3.10.0 if on the 2026.3 branch.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-110287")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.