---
id: "CVE-2026-126326"
page: "https://infrastack.ai/live/CVE-2026-126326"
kind: "vulnerability"
aliases: ["CVE-2026-126326"]
title: "Devolutions Server: user with only vault assignment rights can escalate and read vault passwords"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Devolutions Server", "fixed": ["2026.3.14.0"], "affected": "<= 2026.3.13.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["devolutions-server", "package", "password-manager", "self-hosted"]
not_affected_if: ["no-vault-assignment-delegates", "version-after-2026.3.13.0"]
published_at: "2026-11-11T22:17:26+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:47:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126326", "first_seen_at": "2026-11-11T22:29:34+00:00"}, {"source": "analyst", "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/", "first_seen_at": "2026-11-11T22:35:32+00:00", "cites": ["https://devolutions.net/security/advisories/DEVO-2026-0041/", "https://forum.devolutions.net/forums/105/current-releases"]}]
exploit_sources: []
---

# Devolutions Server: user with only vault assignment rights can escalate and read vault passwords

Link for people: https://infrastack.ai/live/CVE-2026-126326 (this .md is for agents)

Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its administrative role assignment endpoint. An authenticated user with only vault assignment rights can send a crafted role assignment request to gain more privileges and read vault entry passwords.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Devolutions Server affected <= 2026.3.13.0 fixed 2026.3.14.0

## How to check

- Check the Devolutions Server version in the admin UI; versions 2026.3.13.0 and earlier are listed as affected.
- Review which accounts hold the 'manage vault assignments' administrative rights; only those users can use this flaw.
- The advisory lists the 2026.2 branch (2026.2.23.0 and earlier, fixed in 2026.2.24.0) as affected for the other CVEs in DEVO-2026-0041, but names only 2026.3.13.0 and earlier for this one. If you run 2026.2.x, upgrade to 2026.2.24.0 or later anyway.

## Fix

Upgrade Devolutions Server to 2026.3.14.0 or higher (vendor advisory DEVO-2026-0041).

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126326
- 2026-11-11T22:35:32+00:00 analyst https://devolutions.net/security/advisories/DEVO-2026-0041/ — Read vendor advisory DEVO-2026-0041: fix 2026.3.14.0; vendor CVSS 3.1 4.9 Medium (PR:H), so severity lowered from high to medium. No exploitation or PoC reported. 2026.3.14.0 release notes confirm the fix. Same advisory covers CVE-2026-126327/28/31/32.

## Documents

- [advisory] Devolutions DEVO-2026-0041 https://devolutions.net/security/advisories/DEVO-2026-0041/
- [fix] Devolutions Server 2026.3.14.0 release notes https://forum.devolutions.net/forums/105/current-releases

## From the sources

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_