{"id":"CVE-2026-110804","kind":"vulnerability","aliases":["CVE-2026-110804"],"related":[],"title":"Devolutions Server: PAM checkout lets users delete AD groups or keep privileges","description":"Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.","summary":"Devolutions Server accepts client-supplied just-in-time elevation settings in PAM checkout update requests, so an authenticated user with PAM checkout access can alter them. The flaw lets that user delete arbitrary Active Directory groups or keep elevated privileges after checkout.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"devolutions server","fixed":["2026.2.20.0"],"affected":"< 2026.2.20.0","ecosystem":"vendor"},{"name":"devolutions server","fixed":["2026.3.10.0"],"affected":">= 2026.3.5.0, < 2026.3.10.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["active-directory","devolutions-server","pam","self-hosted","vendor"],"not_affected_if":["fixed-version","no-pam-checkout-users"],"how_to_check":"- Check the installed Devolutions Server version in the admin console or the server's installed program list; the affected range is up to `2026.2.20.0` and `>= 2026.3.5.0, < 2026.3.10.0`, per the sources' affected versions.\n- Confirm whether PAM checkout with JIT elevation is in use in your deployment.","fix":"- Upgrade Devolutions Server to `2026.3.10.0` if on the `2026.3.5.0` to `2026.3.9.x` line.\n- Upgrade Devolutions Server to `2026.2.20.0` if on an earlier release.","status":"open","published_at":"2026-10-16T14:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:39:58+00:00","updated_at":"2026-10-25T04:39:58+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T04:39:58Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Devolutions Server to `2026.3.10.0` if on the `2026.3.5.0` to `2026.3.9.x` line.\n- Upgrade Devolutions Server to `2026.2.20.0` if on an earlier release.","reach":"network","title":"Devolutions Server: PAM checkout lets users delete AD groups or keep privileges","impact":"medium","summary":"Devolutions Server accepts client-supplied just-in-time elevation settings in PAM checkout update requests, so an authenticated user with PAM checkout access can alter them. The flaw lets that user delete arbitrary Active Directory groups or keep elevated privileges after checkout.","category":"vendor","nicknames":[],"who_cares":["devolutions-server","pam","active-directory","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated user deletes AD groups or keeps elevated privileges.","analyst_note":"Confirm the exact affected and fixed version boundaries and any required non-default setup at the NVD entry or the Devolutions advisory.","how_to_check":"- Check the installed Devolutions Server version in the admin console or the server's installed program list; the affected range is up to `2026.2.20.0` and `>= 2026.3.5.0, < 2026.3.10.0`, per the sources' affected versions.\n- Confirm whether PAM checkout with JIT elevation is in use in your deployment.","needs_analyst":true,"not_affected_if":["fixed-version","no-pam-checkout-users"],"who_is_affected":"Deployments of Devolutions Server that use PAM checkout with just-in-time elevation and give users PAM checkout access are exposed. The sources do not say which other configurations are required, so the unknown parts are not assumed. Teams not running Devolutions Server, or running a fixed version, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000681,"input_tokens":3414,"output_tokens":680,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110804':15A,18A '-2026':14A,17A '2026.3.8.0':91C 'accept':36B 'access':58B,101C 'activ':24B,69B,105C 'active-directori':23B 'ad':8A 'allow':94C 'alter':60B 'arbitrari':68B,104C 'authent':53B,96C 'checkout':4A,48B,57B,77B,87C,100C,121C 'client':38B,114C 'client-suppli':37B,113C 'control':79C 'cve':13A,16A 'delet':7A,67B,103C 'devolut':1A,27B,34B,89C 'devolutions':19A,21A 'devolutions-serv':26B 'directori':25B,70B,106C 'earlier':93C 'elev':44B,74B,83C,110C,117C 'flaw':63B 'group':9A,71B,107C 'host':32B 'improp':78C 'jit':82C,116C 'just-in-tim':40B 'keep':11A,73B 'let':5A,64B 'modif':80C 'pam':3A,29B,47B,56B,86C,99C 'privileg':12A,75B,111C 'request':50B,123C 'retain':109C 'self':31B 'self-host':30B 'server':2A,20A,22A,28B,35B,90C 'set':45B,84C,118C 'suppli':39B,115C 'time':43B 'updat':49B,122C 'user':6A,54B,66B,97C 'vendor':33B 'via':112C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Devolutions Server that use PAM checkout with just-in-time elevation and give users PAM checkout access are exposed. The sources do not say which other configurations are required, so the unknown parts are not assumed. Teams not running Devolutions Server, or running a fixed version, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110804","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110804","severity":null,"published_at":"2026-10-16T14:17:22+00:00","modified_at":"2026-10-23T18:36:58+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}