DEVOLUTIONS SERVER · CVE-2026-126326 · Package
FIX → 2026.3.14.0 ✓ verified
Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its administrative role assignment endpoint. An authenticated user with only vault assignment rights can send a crafted role assignment request to gain more privileges and read vault entry passwords.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Devolutions Server 2026.3.13.0 and earlier. Exposure needs an authenticated account that holds vault assignment management rights, which can send a crafted role assignment request to read vault entry passwords. Teams that give no one those rights, or that run 2026.3.14.0 or later, can skip it. Devolutions' advisory does not say whether any default configuration is affected.
Not affected if no-vault-assignment-delegates, version-after-2026.3.13.0
Who cares devolutions-server, password-manager, self-hosted
Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.3.14.0
Upgrade Devolutions Server to 2026.3.14.0 or higher (vendor advisory DEVO-2026-0041).