CVE-2026-110287: Devolutions Server Auth Bypass Vulnerability

CVE-2026-110287 Overview

CVE-2026-110287 is an improper access control vulnerability in Devolutions Server 2026.3.8.0 and earlier. The flaw allows an authenticated user holding general Edit permission, but lacking the specific Edit asset permission, to modify the asset contact password. Exploitation occurs by issuing a crafted direct request to the partial-save endpoint, bypassing the intended permission boundary. The weakness is classified under CWE-863: Incorrect Authorization.

Critical Impact

Authenticated users without Edit asset permission can tamper with asset contact passwords, undermining the integrity of credential records managed by Devolutions Server.

Affected Products

• Devolutions Server versions 2026.3.8.0 and earlier
• Devolutions Server partial-save endpoint handling asset contact passwords
• Deployments relying on granular Edit asset permission enforcement

Discovery Timeline

• 2026-10-16 - CVE-2026-110287 published to NVD
• 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-110287

Vulnerability Analysis

The vulnerability resides in the server-side authorization logic that governs edits to asset contact records. Devolutions Server exposes a partial-save endpoint intended to persist incremental changes to asset data. The endpoint checks that the caller holds a general Edit permission but fails to verify the more specific Edit asset permission required to modify contact password fields.

An authenticated user with limited editing rights can therefore change the stored asset contact password. The impact is bounded: confidentiality and availability are unaffected, while integrity of the password field is compromised. According to the vendor advisory, no authentication bypass or remote code execution is possible through this flaw.

Root Cause

The root cause is missing granular authorization enforcement on the partial-save handler. The code path validates coarse-grained edit capability but does not re-check field-level permissions before applying changes to the asset contact password attribute. This is a classic [CWE-863] authorization decision gap where the server trusts the request shape instead of re-evaluating the user's effective permissions for each sensitive field.

Attack Vector

The attack requires network access to the Devolutions Server web interface and valid credentials for a low-privileged account that holds general Edit rights. The attacker crafts a direct HTTP request to the partial-save endpoint containing the modified asset contact password payload. No user interaction and no elevated privileges are required beyond the initial authenticated session.

For technical details, see the Devolutions Security Advisory DEVO-2026-0036.

Detection Methods for CVE-2026-110287

Indicators of Compromise

• Unexpected POST requests to the partial-save endpoint originating from accounts without Edit asset permission.
• Audit log entries showing asset contact password changes performed by users who should not have that capability.
• Asset contact records whose password field changed without a corresponding administrative change ticket.

Detection Strategies

• Enable and review Devolutions Server audit logs for all modifications to asset contact objects, correlating actor identity with assigned permissions.
• Baseline normal usage of the partial-save endpoint and alert on calls that modify password fields when the caller lacks Edit asset rights.
• Compare permission assignments against the set of users who have successfully invoked asset edits over the past 90 days.

Monitoring Recommendations

• Forward Devolutions Server application and audit logs to a centralized SIEM for retention and correlation.
• Alert on sudden spikes in partial-save requests from a single user or source IP address.
• Monitor for privilege-permission drift where low-privileged accounts begin performing edit operations on asset records.

How to Mitigate CVE-2026-110287

Immediate Actions Required

• Upgrade Devolutions Server to a version later than 2026.3.8.0 as indicated in the vendor advisory.
• Review all user and role assignments to confirm that general Edit permission is not over-granted to accounts that should not touch asset data.
• Rotate asset contact passwords that may have been modified while the vulnerable version was in production.

Patch Information

Devolutions published remediation guidance in Devolutions Security Advisory DEVO-2026-0036. Administrators should apply the fixed release identified in the advisory to restore proper permission enforcement on the partial-save endpoint.

Workarounds

• Restrict the general Edit permission to trusted administrators until the patch is deployed.
• Place the Devolutions Server web interface behind network controls that limit access to known administrative workstations.
• Enable detailed audit logging on asset modifications and review entries daily during the exposure window.

# Review Devolutions Server user permissions via PowerShell module
Get-DSUser | Where-Object { $_.Permissions -contains 'Edit' -and $_.Permissions -notcontains 'EditAsset' }