{"id":"CVE-2026-120783","kind":"vulnerability","aliases":["CVE-2026-120783"],"related":[],"title":"Azure DevOps Server: weak authentication lets a user gain higher privileges","description":"Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.","summary":"Azure DevOps Server has a weak authentication flaw. An attacker who already holds a valid account can use it over the network to elevate their privileges.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["azure-devops-server","self-hosted","vendor"],"not_affected_if":["azure-devops-services"],"how_to_check":"- Confirm your Azure DevOps Server version (`unknown` version data in the sources)\n- Review which accounts have valid access to the server; the sources do not name specific settings to check","fix":null,"status":"open","published_at":"2026-11-10T19:20:27+00:00","first_seen_at":"2026-11-10T19:25:08+00:00","triaged_at":"2026-11-10T19:58:16+00:00","updated_at":"2026-11-10T19:58:16+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:58:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Azure DevOps Server: weak authentication lets a user gain higher privileges","impact":"medium","summary":"Azure DevOps Server has a weak authentication flaw. An attacker who already holds a valid account can use it over the network to elevate their privileges.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["azure-devops-server","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"authenticated user gains elevated privileges on the server","analyst_note":"Find affected and fixed Azure DevOps Server versions and any vendor advisory from the Microsoft Security Response Center, since the NVD entry gives none.","how_to_check":"- Confirm your Azure DevOps Server version (`unknown` version data in the sources)\n- Review which accounts have valid access to the server; the sources do not name specific settings to check","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["azure-devops-services"],"who_is_affected":"Organizations that run Azure DevOps Server on their own infrastructure and have users with valid accounts. The sources do not list affected versions or the specific configuration that is exposed, so the scope is unknown. Azure DevOps Services (the hosted version) is not described in the sources.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000698,"input_tokens":4487,"output_tokens":498,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120783':14A,17A '-2026':13A,16A 'account':41B 'allow':58C 'alreadi':37B 'attack':35B,61C 'authent':5A,32B,53C 'author':60C 'azur':1A,19B,26B,55C 'azure-devops-serv':18B 'cve':12A,15A 'devop':2A,20B,27B,56C 'elev':49B,63C 'flaw':33B 'gain':9A 'higher':10A 'hold':38B 'host':24B 'let':6A 'network':47B,67C 'privileg':11A,51B,64C 'self':23B 'self-host':22B 'server':3A,21B,28B,57C 'use':43B 'user':8A 'valid':40B 'vendor':25B 'weak':4A,31B,52C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run Azure DevOps Server on their own infrastructure and have users with valid accounts. The sources do not list affected versions or the specific configuration that is exposed, so the scope is unknown. Azure DevOps Services (the hosted version) is not described in the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["azuredevopsserver","medium","selfhosted","vendor"],"campaign_type":null,"search_a":"'-120783':14A,17A '-2026':13A,16A 'authent':5A 'azur':1A 'cve':12A,15A 'devop':2A 'gain':9A 'higher':10A 'let':6A 'privileg':11A 'server':3A 'user':8A 'weak':4A","search_b":"'account':41B 'alreadi':37B 'attack':35B 'authent':32B 'azur':19B,26B 'azure-devops-serv':18B 'devop':20B,27B 'elev':49B 'flaw':33B 'hold':38B 'host':24B 'network':47B 'privileg':51B 'self':23B 'self-host':22B 'server':21B,28B 'use':43B 'valid':40B 'vendor':25B 'weak':31B","search_c":"'allow':58C 'attack':61C 'authent':53C 'author':60C 'azur':55C 'devop':56C 'elev':63C 'network':67C 'privileg':64C 'server':57C 'weak':52C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:27+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120783","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120783","severity":null,"published_at":"2026-11-10T19:20:27+00:00","modified_at":"2026-11-10T19:20:27+00:00","first_seen_at":"2026-11-10T19:25:08+00:00","fetched_at":"2026-11-10T19:25:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}