{"id":"CVE-2026-110287","kind":"vulnerability","aliases":["CVE-2026-110287"],"related":[],"title":"Devolutions Server: low-privilege editors can change asset contact passwords","description":"Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.","summary":"Devolutions Server has an access control flaw in the asset contact password field. A user with general Edit rights but without asset Edit permission can change that password by sending a crafted request to the partial-save endpoint.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"devolutions server","fixed":["2026.2.20.0"],"affected":"< 2026.2.20.0","ecosystem":"vendor"},{"name":"devolutions server","fixed":["2026.3.10.0"],"affected":">= 2026.3.5.0, < 2026.3.10.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["devolutions-server","self-hosted","vendor","windows"],"not_affected_if":["fixed-version","no-general-edit-users"],"how_to_check":"- Check the installed Devolutions Server version against the affected ranges: below `2026.2.20.0`, or from `2026.3.5.0` up to but not including `2026.3.10.0`.\n- Review which accounts hold general Edit rights without asset Edit permission, since those are the accounts that can use this flaw.","fix":"- Upgrade Devolutions Server to `2026.2.20.0` if on the older branch, or to `2026.3.10.0` if on the 2026.3 branch.","status":"open","published_at":"2026-10-16T14:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:41:09+00:00","updated_at":"2026-10-25T04:41:09+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T04:41:09Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Devolutions Server to `2026.2.20.0` if on the older branch, or to `2026.3.10.0` if on the 2026.3 branch.","reach":"network","title":"Devolutions Server: low-privilege editors can change asset contact passwords","impact":"medium","summary":"Devolutions Server has an access control flaw in the asset contact password field. A user with general Edit rights but without asset Edit permission can change that password by sending a crafted request to the partial-save endpoint.","category":"vendor","nicknames":[],"who_cares":["devolutions-server","self-hosted","windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"A low-privilege authenticated user changes asset contact passwords without permission.","analyst_note":"","how_to_check":"- Check the installed Devolutions Server version against the affected ranges: below `2026.2.20.0`, or from `2026.3.5.0` up to but not including `2026.3.10.0`.\n- Review which accounts hold general Edit rights without asset Edit permission, since those are the accounts that can use this flaw.","needs_analyst":false,"not_affected_if":["fixed-version","no-general-edit-users"],"who_is_affected":"Only Devolutions Server installations on the affected version ranges are exposed, and the attacker must already hold a valid account with general Edit rights. Installations where users with general Edit also hold asset Edit permission, or where the vendor's fixed versions are already running, are not meaningfully exposed to this specific flaw.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000617,"input_tokens":3380,"output_tokens":559,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110287':14A,17A '-2026':13A,16A '2026.3.8.0':79C 'access':34B,70C 'allow':82C 'asset':9A,39B,51B,73C,92C,97C 'authent':84C 'chang':8A,55B 'contact':10A,40B,74C,98C 'control':35B,71C 'craft':61B,102C 'cve':12A,15A 'devolut':1A,23B,30B,77C 'devolutions':18A,20A 'devolutions-serv':22B 'direct':103C 'earlier':81C 'edit':47B,52B,88C,91C 'editor':6A 'endpoint':68B,110C 'field':42B 'flaw':36B 'general':46B,87C 'host':27B 'improp':69C 'low':4A 'low-privileg':3A 'modifi':95C 'partial':66B,108C 'partial-sav':65B,107C 'password':11A,41B,57B,75C,99C 'permiss':53B,93C 'privileg':5A 'request':62B,104C 'right':48B 'save':67B,109C 'self':26B 'self-host':25B 'send':59B 'server':2A,19A,21A,24B,31B,78C 'user':44B,85C 'vendor':28B 'via':100C 'window':29B 'without':50B,90C","nicknames":[],"mitigations":[],"who_affected":"Only Devolutions Server installations on the affected version ranges are exposed, and the attacker must already hold a valid account with general Edit rights. Installations where users with general Edit also hold asset Edit permission, or where the vendor's fixed versions are already running, are not meaningfully exposed to this specific flaw.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110287","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110287","severity":null,"published_at":"2026-10-16T14:17:22+00:00","modified_at":"2026-10-23T18:32:44+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}