{"id":"CVE-2026-126326","kind":"vulnerability","aliases":["CVE-2026-126326"],"related":[],"title":"Devolutions Server: user with only vault assignment rights can escalate and read vault passwords","description":"Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.","summary":"Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its administrative role assignment endpoint. An authenticated user with only vault assignment rights can send a crafted role assignment request to gain more privileges and read vault entry passwords.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Devolutions Server","fixed":["2026.3.14.0"],"affected":"<= 2026.3.13.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["devolutions-server","package","password-manager","self-hosted"],"not_affected_if":["no-vault-assignment-delegates","version-after-2026.3.13.0"],"how_to_check":"- Check the Devolutions Server version in the admin UI; versions 2026.3.13.0 and earlier are listed as affected.\n- Review which accounts hold the 'manage vault assignments' administrative rights; only those users can use this flaw.\n- The advisory lists the 2026.2 branch (2026.2.23.0 and earlier, fixed in 2026.2.24.0) as affected for the other CVEs in DEVO-2026-0041, but names only 2026.3.13.0 and earlier for this one. If you run 2026.2.x, upgrade to 2026.2.24.0 or later anyway.","fix":"Upgrade Devolutions Server to 2026.3.14.0 or higher (vendor advisory DEVO-2026-0041).","status":"open","published_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:34:11+00:00","updated_at":"2026-11-11T22:47:50+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-11T22:34:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Devolutions Server: low-privilege user can escalate to read vault passwords","impact":"high","summary":"Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its administrative role assignment endpoint. An authenticated user with only vault assignment rights can send a crafted role assignment request to gain more privileges and read vault entry passwords.","audience":"businesses","category":"package","nicknames":[],"who_cares":["devolutions-server","self-hosted","password-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker reads all vault entry passwords after escalating privileges","analyst_note":"Check the NVD entry and Devolutions advisory for the fixed version and whether default configurations are affected.","how_to_check":"- Confirm the installed Devolutions Server version is `2026.3.13.0` or earlier\n- Review which accounts hold vault assignment management rights\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-after-2026.3.13.0"],"who_is_affected":"Organizations that run a self-hosted Devolutions Server and grant users vault assignment management rights are exposed. Installations on later versions, or with no users holding those rights, are not affected by this description. The sources do not say whether a default configuration is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000711,"input_tokens":4534,"output_tokens":515,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and Devolutions advisory for the fixed version and whether default configurations are affected.","search":"'-126326':17A,20A '-2026':16A,19A '2026.3.13.0':35B,85C 'access':40B,74C 'administr':45B,78C 'allow':88C 'assign':7A,47B,55B,62B,80C,95C,110C 'authent':50B,90C 'control':41B,75C 'craft':60B,108C 'cve':15A,18A 'devolut':1A,24B,33B,83C 'devolutions':21A 'devolutions-serv':23B 'earlier':37B,87C 'endpoint':48B,81C 'entri':71B,104C 'escal':10A,99C 'flaw':42B 'gain':65B 'host':32B 'improp':73C 'manag':29B,96C 'packag':26B 'password':14A,28B,72B,105C 'password-manag':27B 'privileg':67B,100C 'read':12A,69B,102C 'request':63B,111C 'right':8A,56B,97C 'role':46B,61B,79C,109C 'self':31B 'self-host':30B 'send':58B 'server':2A,22A,25B,34B,84C 'user':3A,51B,91C 'vault':6A,13A,54B,70B,94C,103C 'via':106C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Devolutions Server 2026.3.13.0 and earlier. Exposure needs an authenticated account that holds vault assignment management rights, which can send a crafted role assignment request to read vault entry passwords. Teams that give no one those rights, or that run 2026.3.14.0 or later, can skip it. Devolutions' advisory does not say whether any default configuration is affected.","tier":"C","verified":{"fix":{"at":"2026-11-11T22:35:32Z","by":"analyst","doc":"https://forum.devolutions.net/forums/105/current-releases","run_id":3616},"products":{"at":"2026-11-11T22:35:32Z","by":"analyst","doc":"https://forum.devolutions.net/forums/105/current-releases","run_id":3616},"how_to_check":{"at":"2026-11-11T22:35:32Z","by":"analyst","doc":"https://forum.devolutions.net/forums/105/current-releases","run_id":3616},"who_affected":{"at":"2026-11-11T22:35:32Z","by":"analyst","doc":"https://forum.devolutions.net/forums/105/current-releases","run_id":3616}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["devolutionsserver","server"],"ptokens":["devolutions","server"],"labels":["devolutionsserver","medium","package","passwordmanager","selfhosted"],"campaign_type":null,"search_a":"'-126326':17A,20A '-2026':16A,19A 'assign':7A 'cve':15A,18A 'devolut':1A 'devolutions':21A 'escal':10A 'password':14A 'read':12A 'right':8A 'server':2A,22A 'user':3A 'vault':6A,13A","search_b":"'2026.3.13.0':35B 'access':40B 'administr':45B 'assign':47B,55B,62B 'authent':50B 'control':41B 'craft':60B 'devolut':24B,33B 'devolutions-serv':23B 'earlier':37B 'endpoint':48B 'entri':71B 'flaw':42B 'gain':65B 'host':32B 'manag':29B 'packag':26B 'password':28B,72B 'password-manag':27B 'privileg':67B 'read':69B 'request':63B 'right':56B 'role':46B,61B 'self':31B 'self-host':30B 'send':58B 'server':25B,34B 'user':51B 'vault':54B,70B","search_c":"'2026.3.13.0':85C 'access':74C 'administr':78C 'allow':88C 'assign':80C,95C,110C 'authent':90C 'control':75C 'craft':108C 'devolut':83C 'earlier':87C 'endpoint':81C 'entri':104C 'escal':99C 'improp':73C 'manag':96C 'password':105C 'privileg':100C 'read':102C 'request':111C 'right':97C 'role':79C,109C 'server':84C 'user':91C 'vault':94C,103C 'via':106C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126326","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126326","severity":null,"published_at":"2026-11-11T22:17:26+00:00","modified_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126326:3616","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","severity":null,"published_at":"2026-11-11T22:35:32+00:00","modified_at":"2026-11-11T22:35:32+00:00","first_seen_at":"2026-11-11T22:35:32+00:00","fetched_at":"2026-11-11T22:35:32+00:00","note":"Read vendor advisory DEVO-2026-0041: fix 2026.3.14.0; vendor CVSS 3.1 4.9 Medium (PR:H), so severity lowered from high to medium. No exploitation or PoC reported. 2026.3.14.0 release notes confirm the fix. Same advisory covers CVE-2026-126327/28/31/32.","cites":["https://devolutions.net/security/advisories/DEVO-2026-0041/","https://forum.devolutions.net/forums/105/current-releases"]}],"documents":[{"id":129656,"url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","title":"Devolutions DEVO-2026-0041","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":129658,"url":"https://forum.devolutions.net/forums/105/current-releases","title":"Devolutions Server 2026.3.14.0 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}