CVE-2026-105488: Devolutions Server Auth Bypass Vulnerability

CVE-2026-105488 Overview

CVE-2026-105488 is a missing authorization vulnerability in Devolutions Server 2026.3.7.0 and earlier. The flaw resides in the global vault component. An authenticated user holding only the global vault view permission can modify and delete global contact and folder entries. The issue maps to CWE-862: Missing Authorization and carries a network-exploitable attack vector with low privilege requirements. Devolutions published advisory DEVO-2026-0035 to track the issue.

Critical Impact

Users granted read-only access to the global vault can alter or destroy shared contact and folder data, undermining the integrity of centralized secret and asset management.

Affected Products

• Devolutions Server 2026.3.7.0
• Devolutions Server versions earlier than 2026.3.7.0
• Global vault component (contacts and folders)

Discovery Timeline

• 2026-10-06 - CVE-2026-105488 published to NVD
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-105488

Vulnerability Analysis

Devolutions Server implements a role-based permission model for the global vault. The expected behavior assigns separate permissions for viewing, modifying, and deleting entries. In affected builds, the server enforces the view permission at the user interface and read API layer but does not re-check write permissions on the server side for global contact and folder entries. An authenticated user with only view access can therefore submit modification and deletion requests that the backend accepts.

The integrity impact is high because global vault entries are shared across the organization. Attackers with low-privileged accounts can tamper with shared folder structures, alter contact records, or remove entries that other users rely on for secret organization and access workflows.

Root Cause

The root cause is a missing server-side authorization check on the write and delete code paths for global contacts and folders. The application trusts the client-side permission state rather than independently validating that the caller holds the required modify or delete permission for each operation.

Attack Vector

Exploitation requires an authenticated session with at least global vault view permission. The attacker crafts modification or deletion requests against the global vault API endpoints responsible for contacts and folders. Because the operation is a standard HTTP request, no social engineering or user interaction is required. See the Devolutions Security Advisory DEVO-2026-0035 for vendor-specific technical details.

// No verified proof-of-concept code is published for this issue.
// Refer to Devolutions advisory DEVO-2026-0035 for technical specifics.

Detection Methods for CVE-2026-105488

Indicators of Compromise

• Unexpected modification or deletion of global contact entries by accounts that should only have view permission
• Missing or altered global vault folders reported by administrators or end users
• Audit log entries showing write or delete operations on /api/vault/global/contacts or folder endpoints from low-privilege accounts

Detection Strategies

• Review Devolutions Server audit logs for write and delete actions on global vault contacts and folders, correlated with the acting user's assigned permission set
• Alert on any discrepancy between a user's documented role and the operations they perform against the global vault
• Baseline normal change frequency for global folders and contacts, then flag outliers

Monitoring Recommendations

• Forward Devolutions Server audit logs to a centralized SIEM or data lake for continuous review
• Monitor administrative dashboards for changes to global vault structure outside of approved change windows
• Enable alerting on bulk deletion events targeting global contact or folder objects

How to Mitigate CVE-2026-105488

Immediate Actions Required

• Upgrade Devolutions Server to a version later than 2026.3.7.0 as directed by advisory DEVO-2026-0035
• Audit current global vault permission assignments and remove unnecessary view access from accounts that do not require it
• Review recent audit log activity to identify any unauthorized modifications or deletions

Patch Information

Devolutions addresses the issue in versions released after 2026.3.7.0. Consult the Devolutions Security Advisory DEVO-2026-0035 for the fixed version and upgrade instructions.

Workarounds

• Restrict global vault view permission to a minimal set of trusted users until the patch is applied
• Enable and actively monitor audit logging for all global vault operations
• Consider moving sensitive contact and folder entries out of the global vault into vaults with more restrictive membership

# Example: verify installed Devolutions Server version on Windows
Get-ItemProperty -Path 'HKLM:\Software\Devolutions\Devolutions Server' | Select-Object Version