CVE-2026-90969: Devolutions Server Auth Bypass Vulnerability

CVE-2026-90969 Overview

CVE-2026-90969 is an improper access control vulnerability [CWE-284] in the vault entry listing feature of Devolutions Server 2026.2.16 and earlier. An authenticated user without the view-password permission can retrieve cleartext passwords by sending a crafted request to the entry listing endpoint with password disclosure parameters. The flaw undermines the permission model that separates users who may enumerate vault entries from those authorized to view secret material. Any authenticated principal with basic vault visibility can obtain credentials they were explicitly denied.

Critical Impact
Authenticated users bypass password view restrictions and harvest cleartext credentials from vault entries, enabling downstream account takeover and lateral movement.

Affected Products

Devolutions Server 2026.2.16 and earlier

Discovery Timeline

2026-09-15 - CVE-2026-90969 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90969

Vulnerability Analysis

Devolutions Server implements a role-based permission model that separates the ability to list vault entries from the ability to view the secrets stored inside them. The view-password permission is intended to gate access to cleartext credential material. In affected versions, the entry listing endpoint honors password disclosure parameters in the request without verifying that the requesting user holds view-password. The server returns entry metadata together with cleartext passwords in the response body.

The issue is a classic broken access control failure. Authorization is enforced at the listing layer but not at the field selection layer. An attacker with any authenticated session that can enumerate vault entries inherits the ability to read those entries' secrets by adjusting request parameters. The impact scales with the size and sensitivity of the vault content exposed to the account.

Root Cause

The root cause is missing authorization on optional response fields. The listing endpoint evaluates the caller's list permission but does not re-check permissions when the request opts into password disclosure parameters. The view-password right is effectively bypassed at the API boundary.

Attack Vector

Exploitation requires an authenticated account with permission to list entries in a vault. The attacker issues a request to the entry listing endpoint and includes the password disclosure parameters documented for privileged callers. The server returns cleartext passwords in the JSON response. No user interaction, elevated role, or memory corruption is involved. Refer to the Devolutions Security Advisory DEVO-2026-0030 for vendor-supplied technical detail.

Detection Methods for CVE-2026-90969

Indicators of Compromise

Requests to the vault entry listing endpoint that include password disclosure query parameters originating from user accounts without the view-password permission.
Unusually large or repeated entry listing responses returned to a single authenticated session.
Access log entries showing enumeration of vault entries followed by authentication attempts to systems whose credentials are stored in those entries.

Detection Strategies

Correlate Devolutions Server audit logs with role assignments to identify listing requests where the caller lacks view-password yet receives password fields.
Alert on any HTTP request to the entry listing endpoint containing password disclosure parameters, and validate the caller's assigned permissions.
Baseline normal vault listing volume per user and flag deviations that suggest bulk credential harvesting.

Monitoring Recommendations

Forward Devolutions Server application and audit logs to a centralized SIEM for correlation with authentication events on downstream systems.
Monitor for post-exploitation reuse of stored credentials by watching for successful logins from new source addresses shortly after vault listing activity.
Track privilege changes in Devolutions Server so that new grants of listing rights are reviewed before deployment.

How to Mitigate CVE-2026-90969

Immediate Actions Required

Upgrade Devolutions Server to a version later than 2026.2.16 as published in DEVO-2026-0030.
Rotate any credentials stored in Devolutions Server vaults that were accessible to users without the view-password permission during the exposure window.
Audit user and group permissions on all vaults and remove listing rights from accounts that do not require them.

Patch Information

Devolutions has published security advisory DEVO-2026-0030 addressing the improper access control in the vault entry listing feature. Administrators should apply the fixed release identified in the advisory and restart the Devolutions Server service. Review the Devolutions Security Advisory DEVO-2026-0030 for the specific fixed version and upgrade guidance.

Workarounds

Restrict vault entry listing permissions to the minimum set of users who require enumeration, pending patch deployment.
Segment sensitive vaults so that only administrators with view-password retain any access, reducing the attacker-reachable credential surface.
Increase audit log retention and review frequency to detect abuse until the patched version is installed.

bash

# Configuration example
# Review Devolutions Server role assignments and revoke unnecessary listing rights
# via the administrative console: System Settings > Roles > Vault Permissions
# Confirm the running server version meets the fixed release from DEVO-2026-0030