CVE-2026-100287: Devolutions Server Auth Bypass Vulnerability

CVE-2026-100287 Overview

CVE-2026-100287 is a missing authorization vulnerability in the attachment history API of Devolutions Server. The flaw affects Devolutions Server version 2026.3.5.0 and earlier. An authenticated low-privileged user can permanently delete or restore vault attachments by sending a crafted API request. The issue is classified under CWE-862: Missing Authorization.

Critical Impact
A low-privileged authenticated user can permanently delete or restore vault attachments through the attachment history API, undermining the integrity and availability of stored vault data.

Affected Products

Devolutions Server 2026.3.5.0
All Devolutions Server versions earlier than 2026.3.5.0

Discovery Timeline

2026-09-29 - CVE-2026-100287 published to the National Vulnerability Database (NVD)
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-100287

Vulnerability Analysis

The attachment history API in Devolutions Server exposes endpoints that manage the lifecycle of vault attachments, including deletion and restoration operations. These endpoints fail to enforce authorization checks that validate whether the calling user has the required privileges on the target attachment. As a result, an authenticated account with only low-level access can invoke destructive operations that should be restricted to privileged roles.

The attack requires valid credentials on the Devolutions Server instance but no additional user interaction. Because the operation targets attachments stored inside vaults, exploitation can permanently remove content or reintroduce previously deleted attachments, both of which affect data integrity and availability.

Root Cause

The root cause is a missing authorization check on the attachment history API surface. Server-side handlers process delete and restore requests based on authentication alone, without verifying that the authenticated principal holds the vault-level or attachment-level permissions required for the action. This maps directly to CWE-862.

Attack Vector

The attack vector is network-based and requires authentication with a low-privileged account. An attacker sends a crafted HTTP request to the attachment history endpoint referencing a target attachment identifier. The server processes the request without validating the caller's rights on that attachment, executing the permanent delete or restore action.

No verified public exploit code is available. Refer to the Devolutions Security Advisory DEVO-2026-0034 for vendor-provided technical details.

Detection Methods for CVE-2026-100287

Indicators of Compromise

Unexpected attachment deletion or restoration events in Devolutions Server audit logs, especially those attributed to accounts without vault administration rights.
API calls to the attachment history endpoint originating from low-privileged user sessions.
Vault attachments missing or reappearing without a corresponding legitimate administrative workflow.

Detection Strategies

Correlate attachment history API activity with the effective role of the requesting user to flag privilege mismatches.
Baseline normal attachment delete and restore rates per user and alert on statistical deviations.
Alert on any successful attachment deletion or restoration performed by accounts outside a defined administrator group.

Monitoring Recommendations

Enable and centralize Devolutions Server audit logs covering vault attachment operations.
Forward API access logs to a SIEM and retain them for retrospective investigation of attachment tampering.
Review changes to vault attachment inventories on a scheduled basis and reconcile them against approved change requests.

How to Mitigate CVE-2026-100287

Immediate Actions Required

Upgrade Devolutions Server to a release later than 2026.3.5.0 that contains the fix referenced in DEVO-2026-0034.
Review vault attachment audit history for unauthorized delete or restore actions performed before patching.
Restrict Devolutions Server API access to trusted network segments while patching is planned.

Patch Information

Devolutions has published the fix and remediation guidance in the Devolutions Security Advisory DEVO-2026-0034. Administrators should apply the vendor-provided update to versions after 2026.3.5.0 and validate that the attachment history API rejects requests from users lacking the required permissions.

Workarounds

Reduce the number of low-privileged accounts that can authenticate to Devolutions Server until the patch is applied.
Enforce network-level access controls to limit which clients can reach the Devolutions Server API endpoints.
Increase audit log review frequency for attachment lifecycle events until remediation is confirmed.

bash

# Verify installed Devolutions Server version before and after patching
# (run on the Devolutions Server host)
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Devolutions\Server' | Select-Object DisplayVersion