---
id: "CVE-2026-110287"
kind: "vulnerability"
aliases: ["CVE-2026-110287"]
title: "Devolutions Server: low-privilege editors can change asset contact passwords"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "devolutions server", "fixed": ["2026.2.20.0"], "affected": "< 2026.2.20.0", "ecosystem": "vendor"}, {"name": "devolutions server", "fixed": ["2026.3.10.0"], "affected": ">= 2026.3.5.0, < 2026.3.10.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["devolutions-server", "self-hosted", "vendor", "windows"]
not_affected_if: ["fixed-version", "no-general-edit-users"]
published_at: "2026-10-16T14:17:22+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:41:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110287", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Devolutions Server: low-privilege editors can change asset contact passwords

Devolutions Server has an access control flaw in the asset contact password field. A user with general Edit rights but without asset Edit permission can change that password by sending a crafted request to the partial-save endpoint.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:devolutions server affected < 2026.2.20.0 fixed 2026.2.20.0
- vendor:devolutions server affected >= 2026.3.5.0, < 2026.3.10.0 fixed 2026.3.10.0

## How to check

- Check the installed Devolutions Server version against the affected ranges: below `2026.2.20.0`, or from `2026.3.5.0` up to but not including `2026.3.10.0`.
- Review which accounts hold general Edit rights without asset Edit permission, since those are the accounts that can use this flaw.

## Fix

- Upgrade Devolutions Server to `2026.2.20.0` if on the older branch, or to `2026.3.10.0` if on the 2026.3 branch.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110287

## From the sources

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_