CVE-2026-110806 Overview
CVE-2026-110806 is an incorrect authorization vulnerability [CWE-863] in Devolutions Server 2026.3.8.0 and earlier. The flaw resides in how add-on properties are returned in connection data. An authenticated user holding only View permission can obtain add-on passwords because the server returns unredacted add-on properties. This breaks the least-privilege model intended for view-only roles and exposes credentials to users who should not possess them.
Critical Impact
Any authenticated account with View permission can harvest add-on passwords from Devolutions Server, enabling credential theft and lateral movement across systems referenced by those add-ons.
Affected Products
- Devolutions Server 2026.3.8.0
- Devolutions Server versions prior to 2026.3.8.0
- Add-on properties exposed through the connection data API
Discovery Timeline
- 2026-10-16 - CVE-2026-110806 published to the National Vulnerability Database (NVD)
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-110806
Vulnerability Analysis
The vulnerability is an authorization logic flaw classified under [CWE-863] Incorrect Authorization. Devolutions Server stores add-on properties that may include sensitive secrets such as passwords. When a client requests connection data, the server returns add-on properties without applying permission-based redaction. A user granted only the View role, intended to allow visibility without secret access, receives the unredacted values.
The attack requires network access to the Devolutions Server and valid credentials with at least View permission. No user interaction is needed, and the attacker gains confidentiality impact against secrets stored in add-ons.
Root Cause
The server-side authorization check for add-on property disclosure does not differentiate between permission tiers when serializing connection data. Secret fields that should only be returned to users with explicit Edit or secret-retrieval rights are included in the response payload for View-only requesters. The permission enforcement is applied at the connection level rather than at the individual property level for add-ons.
Attack Vector
An authenticated attacker with View permission on a connection authenticates to the Devolutions Server. The attacker requests connection data for an entry that references an add-on. The response contains the add-on properties in cleartext, including any password fields. The attacker extracts the password and reuses it against the target system or service that the add-on protects.
The vulnerability mechanism is described in prose only; no verified public proof-of-concept code is available at this time. Consult the Devolutions Security Advisory DEVO-2026-0036 for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110806
Indicators of Compromise
- Unexpected volumes of connection data read operations by accounts holding only View permission.
- API responses returning add-on properties with populated secret fields to low-privilege users.
- Subsequent authentication attempts to downstream systems using credentials stored in Devolutions add-ons shortly after a View-user access event.
Detection Strategies
- Audit Devolutions Server activity logs for connection fetch events correlated with user permission level. Flag View role users retrieving entries containing add-ons.
- Compare the volume and breadth of connection reads per user against a historical baseline to identify anomalous enumeration.
- Review downstream authentication logs for use of secrets managed by Devolutions from endpoints that do not match the normal workflow of the owning user.
Monitoring Recommendations
- Forward Devolutions Server audit logs to a centralized logging platform and alert on bulk connection reads by non-privileged accounts.
- Monitor service and system accounts whose passwords are stored as add-ons for unexpected sign-in locations or times.
- Rotate and watch high-value shared credentials managed through Devolutions until the server is patched.
How to Mitigate CVE-2026-110806
Immediate Actions Required
- Upgrade Devolutions Server to a version later than 2026.3.8.0 as published in the vendor advisory.
- Rotate all passwords stored in add-on properties, treating them as potentially disclosed to any View-permission user.
- Review and reduce the number of accounts holding View permission on sensitive entries until patching is complete.
Patch Information
Devolutions has published remediation guidance in Devolutions Security Advisory DEVO-2026-0036. Administrators should apply the fixed release referenced in that advisory and verify the server version after upgrade.
Workarounds
- Temporarily revoke View permission from users who do not require access to entries containing add-ons.
- Migrate highly sensitive secrets out of add-on properties into alternative vault entries with stricter access controls until the patch is applied.
- Enforce multi-factor authentication on all Devolutions Server accounts to limit the blast radius of credential compromise.
# Configuration example
# Verify installed Devolutions Server version against the fixed release
# Review the Devolutions Server administration console: Administration > System > Version
# Audit role assignments:
# Administration > Users and Security > Roles
# Export audit logs for the past 90 days for review:
# Administration > Logs > Export
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
