CVE-2026-15641 Overview
CVE-2026-15641 is an improper authorization vulnerability [CWE-863] in Devolutions Server. The flaw resides in the access request status endpoint and allows an authenticated low-privileged user to approve their own pending access request. Attackers bypass the required approver review by issuing a direct call to the request status endpoint. The vulnerability affects Devolutions Server versions 2026.2.11 and 2026.1.22. Devolutions published advisory DEVO-2026-0024 documenting the issue.
Critical Impact
An authenticated low-privileged user can self-approve pending access requests, gaining unauthorized access to secrets, credentials, or resources gated behind the approval workflow.
Affected Products
- Devolutions Server 2026.2.11
- Devolutions Server 2026.1.22
Discovery Timeline
- 2026-07-14 - CVE-2026-15641 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-15641
Vulnerability Analysis
Devolutions Server implements an access request workflow that gates privileged operations behind approver review. Users submit a request, and a designated approver must review and approve it before access is granted. The access request status endpoint fails to enforce authorization checks that separate the requester from the approver.
An authenticated low-privileged user can call the status endpoint directly and transition their own pending request into an approved state. The server accepts the state change without validating that the caller holds an approver role or that the caller is distinct from the original requester. This breaks the segregation-of-duty control the workflow is designed to enforce.
The impact aligns with the CVSS vector: confidentiality is high because approved requests typically unlock privileged secrets or connections, while integrity impact is limited to the workflow state itself. No user interaction is required, and the attack is fully remote once the attacker holds valid credentials.
Root Cause
The endpoint performs authentication but omits proper authorization logic. It does not verify the caller's role, does not compare the caller's identity against the requester, and does not enforce that only an approver principal can move a request to the approved state. This is a classic [CWE-863] Incorrect Authorization defect.
Attack Vector
The attacker authenticates as any low-privileged user with permission to submit access requests. The attacker submits a request for a target resource, then issues a direct HTTP call to the request status endpoint referencing their own request identifier and setting the state to approved. The server accepts the transition and grants access. The full exploitation path requires only network access to the Devolutions Server web interface and valid low-privileged credentials.
See the Devolutions Security Advisory DEVO-2026-0024 for vendor-supplied technical details.
Detection Methods for CVE-2026-15641
Indicators of Compromise
- Access requests that transition from pending to approved with the same user account listed as both requester and approver in audit logs.
- Approval events on the request status endpoint that lack a corresponding approver review action in the workflow history.
- Unexpected access to sensitive vaults or entries by low-privileged accounts shortly after they submitted a request.
Detection Strategies
- Audit the Devolutions Server activity log for approval events where the acting principal matches the request originator.
- Correlate HTTP access logs against the request status endpoint for POST/PUT calls originating from non-approver accounts.
- Establish a baseline of expected approver accounts and alert on any approval action performed by an account outside that set.
Monitoring Recommendations
- Forward Devolutions Server audit and web server logs to a centralized SIEM for continuous review.
- Alert on abnormal spikes in approval volume, particularly outside business hours or from a single low-privileged account.
- Monitor privileged secret retrieval events that immediately follow an access request approval for the same user.
How to Mitigate CVE-2026-15641
Immediate Actions Required
- Upgrade Devolutions Server to a fixed release as identified in advisory DEVO-2026-0024.
- Review the access request audit log for prior self-approvals and revoke any access granted through the bypass.
- Rotate credentials, keys, and secrets that may have been exposed to low-privileged users through improperly approved requests.
Patch Information
Devolutions has published fix guidance in Devolutions Security Advisory DEVO-2026-0024. Administrators should apply the vendor-supplied update for their branch of Devolutions Server 2026 as soon as possible.
Workarounds
- Restrict network access to the Devolutions Server web interface to trusted administrative networks until the patch is applied.
- Temporarily disable the access request workflow for sensitive vaults and require direct administrator provisioning instead.
- Reduce the population of accounts that can submit access requests to limit the attack surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
