---
id: "CVE-2026-110804"
kind: "vulnerability"
aliases: ["CVE-2026-110804"]
title: "Devolutions Server: PAM checkout lets users delete AD groups or keep privileges"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "devolutions server", "fixed": ["2026.2.20.0"], "affected": "< 2026.2.20.0", "ecosystem": "vendor"}, {"name": "devolutions server", "fixed": ["2026.3.10.0"], "affected": ">= 2026.3.5.0, < 2026.3.10.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["active-directory", "devolutions-server", "pam", "self-hosted", "vendor"]
not_affected_if: ["fixed-version", "no-pam-checkout-users"]
published_at: "2026-10-16T14:17:22+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:39:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110804", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# Devolutions Server: PAM checkout lets users delete AD groups or keep privileges

Devolutions Server accepts client-supplied just-in-time elevation settings in PAM checkout update requests, so an authenticated user with PAM checkout access can alter them. The flaw lets that user delete arbitrary Active Directory groups or keep elevated privileges after checkout.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:devolutions server affected < 2026.2.20.0 fixed 2026.2.20.0
- vendor:devolutions server affected >= 2026.3.5.0, < 2026.3.10.0 fixed 2026.3.10.0

## How to check

- Check the installed Devolutions Server version in the admin console or the server's installed program list; the affected range is up to `2026.2.20.0` and `>= 2026.3.5.0, < 2026.3.10.0`, per the sources' affected versions.
- Confirm whether PAM checkout with JIT elevation is in use in your deployment.

## Fix

- Upgrade Devolutions Server to `2026.3.10.0` if on the `2026.3.5.0` to `2026.3.9.x` line.
- Upgrade Devolutions Server to `2026.2.20.0` if on an earlier release.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110804

## From the sources

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_