CVE-2026-16799 Overview
CVE-2026-16799 is an improper access control vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. The automation tests and workflows features fail to enforce server-side authorization checks. An authenticated user assigned only the Reader role can execute automation tests and modify workflow properties. This weakness is classified as Missing Authorization [CWE-862].
The issue affects the built-in role-based access control model used by administrators to segregate read-only users from operators who can trigger automation. Exploitation requires only valid low-privilege credentials and network access to the PowerShell Universal management interface.
Critical Impact
Reader-role accounts can invoke automation tests and alter workflow properties, bypassing the intended least-privilege boundary in PowerShell Universal deployments.
Affected Products
- Devolutions PowerShell Universal 2026.2.2
- Devolutions PowerShell Universal versions prior to 2026.2.2
- Deployments relying on the Reader role for read-only separation of duties
Discovery Timeline
- 2026-07-24 - CVE-2026-16799 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-16799
Vulnerability Analysis
PowerShell Universal implements a role-based access control (RBAC) model that includes a Reader role intended for read-only access. The automation tests endpoint and the workflow properties endpoint do not validate that the calling identity possesses the required operator-level role. The server accepts requests based solely on authentication rather than authorization.
As a result, an authenticated Reader can trigger execution of automation tests and change workflow property values. Automation tests can execute PowerShell logic within the server context, and workflow modifications can alter subsequent automation behavior. The vulnerability breaks the separation between observers and operators, undermining least-privilege configurations used in shared administrative environments.
Root Cause
The root cause is missing server-side authorization enforcement on the automation tests and workflow properties endpoints. Role checks are either absent or performed only in client-side UI logic. Any authenticated session token, including one bound to the Reader role, satisfies the request handler and permits the privileged operation.
Attack Vector
The attack vector is network-based and requires low privileges. An attacker with valid Reader credentials, obtained through legitimate provisioning or credential compromise, issues direct API requests to the affected endpoints. No user interaction is required. Because the scope changes (S:C in the CVSS vector), impact extends beyond the vulnerable component to workflow logic executed by higher-privileged automation contexts.
Exploitation details are documented in the Devolutions Security Advisory DEVO-2026-0025. No public proof-of-concept code has been published.
Detection Methods for CVE-2026-16799
Indicators of Compromise
- Automation test executions initiated by user accounts assigned only the Reader role in PowerShell Universal audit logs
- Workflow property modifications originating from accounts that should not have write access to automation resources
- Unexpected API requests to automation test and workflow endpoints from low-privilege session tokens
Detection Strategies
- Review PowerShell Universal audit logs and correlate the acting identity's role assignment against the action performed
- Alert on any automation test invocation or workflow update where the actor's effective role is Reader
- Baseline normal operator activity per endpoint and flag deviations from expected role-to-action mappings
Monitoring Recommendations
- Forward PowerShell Universal audit and access logs to a centralized SIEM for role-based anomaly analysis
- Monitor authentication events for Reader accounts making non-read API calls
- Track workflow property change history and require review of modifications performed by non-administrator accounts
How to Mitigate CVE-2026-16799
Immediate Actions Required
- Upgrade Devolutions PowerShell Universal to a version later than 2026.2.2 as published in the vendor advisory
- Audit all accounts currently assigned the Reader role and confirm no unauthorized automation test executions or workflow changes have occurred
- Rotate credentials for any Reader accounts suspected of compromise
Patch Information
Devolutions has published remediation guidance in DEVO-2026-0025. Administrators should apply the fixed release identified in the advisory to restore server-side authorization checks on the automation tests and workflows features.
Workarounds
- Restrict network access to the PowerShell Universal management interface to trusted administrative networks until patching is complete
- Remove or downgrade Reader role assignments for accounts that do not require access to the automation and workflows sections
- Increase audit log retention and enable alerts on automation and workflow endpoint activity while planning the upgrade
# Configuration example
# Review current role assignments in PowerShell Universal
# Consult vendor documentation for the exact cmdlets in your version
Get-PSURole
Get-PSUIdentity | Select-Object Name, Roles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
