{"id":"CVE-2026-114487","kind":"vulnerability","aliases":["CVE-2026-114487"],"related":[],"title":"Devolutions Server: missing authorization lets users create PAM sub-providers","description":"Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.","summary":"Devolutions Server's PAM AD computer import endpoint does not check authorization, so a logged-in non-admin user with a PAM license can create PAM sub-providers under existing AD providers with a crafted request. The sources do not describe data exposure or code execution beyond that.","severity":"medium","cvss":null,"epss":0.00132,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["active-directory","devolutions-server","other","pam"],"not_affected_if":["no-ad-provider","no-pam-license","versions-outside-range"],"how_to_check":"- Confirm the installed Devolutions Server version in the admin console or the server's about page, and compare it with the affected range `2026.3.5.0` through `2026.3.10.0`, and `2026.2.20.0` and earlier.","fix":"- Upgrade Devolutions Server to a version newer than the affected range; the fixed version is unknown from the sources.","status":"open","published_at":"2026-10-22T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T05:00:26+00:00","updated_at":"2026-10-25T05:00:26+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:00:26Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Devolutions Server to a version newer than the affected range; the fixed version is unknown from the sources.","reach":"network","title":"Devolutions Server: missing authorization lets users create PAM sub-providers","impact":"medium","summary":"Devolutions Server's PAM AD computer import endpoint does not check authorization, so a logged-in non-admin user with a PAM license can create PAM sub-providers under existing AD providers with a crafted request. The sources do not describe data exposure or code execution beyond that.","category":"other","nicknames":[],"who_cares":["devolutions-server","pam","active-directory"],"confidence":0.6,"needs_auth":"yes","worst_case":"Authenticated low-privilege user creates unauthorized PAM sub-providers under AD providers","analyst_note":"Find the fixed Devolutions Server version and any vendor advisory for CVE-2026-114487 to fill fix and how_to_check.","how_to_check":"- Confirm the installed Devolutions Server version in the admin console or the server's about page, and compare it with the affected range `2026.3.5.0` through `2026.3.10.0`, and `2026.2.20.0` and earlier.","needs_analyst":true,"not_affected_if":["no-pam-license","no-ad-provider","versions-outside-range"],"who_is_affected":"Teams running Devolutions Server in the listed version ranges with PAM licensing and AD provider integration, where non-admin users have accounts. Installations without PAM or without AD providers are unlikely to be exposed, but the sources do not say this explicitly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000626,"input_tokens":3369,"output_tokens":579,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114487':14A,17A '-2026':13A,16A '2026.2.20.0':92C '2026.3.10.0':90C '2026.3.5.0':88C 'activ':19B 'active-directori':18B 'ad':30B,59B,81C,114C 'admin':45B 'administr':100C 'allow':95C 'authent':97C 'author':4A,37B,77C 'beyond':75B 'check':36B 'code':73B 'comput':31B,82C 'craft':63B,118C 'creat':7A,52B,107C 'cve':12A,15A 'data':70B 'describ':69B 'devolut':1A,22B,26B,86C 'devolutions-serv':21B 'directori':20B 'earlier':94C 'endpoint':33B,84C 'execut':74B 'exist':58B,113C 'exposur':71B 'import':32B,83C,119C 'let':5A 'licens':50B,105C 'log':41B 'logged-in':40B 'miss':3A,76C 'non':44B,99C 'non-admin':43B 'non-administr':98C 'pam':8A,25B,29B,49B,53B,80C,104C,108C 'provid':11A,56B,60B,111C,115C 'request':64B,120C 'server':2A,23B,27B,87C 'sourc':66B 'sub':10A,55B,110C 'sub-provid':9A,54B,109C 'user':6A,46B,101C 'via':116C","nicknames":[],"mitigations":[],"who_affected":"Teams running Devolutions Server in the listed version ranges with PAM licensing and AD provider integration, where non-admin users have accounts. Installations without PAM or without AD providers are unlikely to be exposed, but the sources do not say this explicitly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114487","severity":null,"published_at":"2026-10-22T16:17:34+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114487","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114487","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}