CVE-2026-9251: Devolutions Server Auth Bypass Vulnerability

CVE-2026-9251 Overview

CVE-2026-9251 is a missing authorization vulnerability in the entry status management feature of Devolutions Server. An authenticated non-administrator user can craft a status change request to bypass the administrator-enforced Pending Approval workflow. The bypass grants access to the underlying entry data without administrative approval.

The flaw is tracked under [CWE-862] (Missing Authorization) and affects deployments that rely on the Pending Approval workflow to gate access to sensitive entries such as stored credentials.

Critical Impact
Authenticated users can read entry data that should require administrator approval, undermining the privileged access governance controls of Devolutions Server.

Affected Products

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier
Devolutions Server (Privileged Access Management deployments using the Pending Approval workflow)

Discovery Timeline

2026-05-22 - CVE-2026-9251 published to the National Vulnerability Database
2026-05-22 - Last updated in NVD database
2026-05-28 - EPSS score recorded at 0.03%

Technical Details for CVE-2026-9251

Vulnerability Analysis

Devolutions Server provides a Pending Approval workflow that administrators enable to require explicit approval before a user can retrieve sensitive entry data. The workflow is enforced at the application layer through entry status transitions. When a user requests access, the entry enters a pending state until an administrator approves the request.

The vulnerability stems from missing authorization checks on the entry status management endpoint. The server validates user authentication but does not verify whether the requester is permitted to change the entry status. A non-administrator authenticated user can submit a crafted status change request that transitions the entry to an approved state. The user can then read the entry's protected data, including any stored secrets.

The attack vector is network-based and requires low privileges. No user interaction is needed. Confidentiality and integrity are both affected at a low level because the attacker reads protected data and modifies the entry's approval status.

Root Cause

The root cause is an authorization gap in the entry status management feature. The endpoint trusts the supplied status value without confirming that the caller holds the administrative role required to approve entry access. This is a classic [CWE-862] Missing Authorization pattern where the access control decision is omitted on a state-changing operation.

Attack Vector

An attacker must hold valid credentials for the Devolutions Server instance and have visibility into an entry that is gated by the Pending Approval workflow. The attacker sends a crafted HTTP request to the entry status management endpoint, specifying the approved status. The server processes the request and exposes the entry data. No exploit code is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability is described in the Devolutions Security Advisory DEVO-2026-0013. No verified proof-of-concept code has been published.

Detection Methods for CVE-2026-9251

Indicators of Compromise

Entry status transitions to approved states without a corresponding administrator action in the audit log
Read operations on entries by non-administrator accounts that occur outside an approved Pending Approval request
Unusual volumes of status change API calls originating from a single authenticated user account

Detection Strategies

Review Devolutions Server audit logs for entry status changes and correlate them with the identity of the approving account; flag transitions where the approver is the same user requesting access
Alert on any access to entries protected by Pending Approval where no approval record exists
Baseline normal status management API usage per role and alert on non-administrator accounts invoking status change operations

Monitoring Recommendations

Ingest Devolutions Server audit logs into a centralized SIEM and retain them for forensic review of historical entry access
Monitor for repeated 200 OK responses to entry status management requests from low-privilege user sessions
Track entry data retrieval events and compare them against the corresponding approval workflow records to identify gaps

How to Mitigate CVE-2026-9251

Immediate Actions Required

Upgrade Devolutions Server to a fixed release above 2026.1.16.0, or to the corresponding fixed build in the 2025.3 branch as listed in the vendor advisory
Audit all entries protected by the Pending Approval workflow for unauthorized status changes since the affected versions were deployed
Rotate credentials and secrets stored in entries that may have been accessed through the bypass

Patch Information

Devolutions has published remediation guidance in Devolutions Security Advisory DEVO-2026-0013. Administrators should follow the advisory to identify the fixed version applicable to their branch and apply it through the standard Devolutions Server upgrade process.

Workarounds

Restrict Devolutions Server access to trusted networks until the patch is applied to reduce the population of authenticated users who could exploit the flaw
Temporarily revoke unnecessary user accounts and review role assignments to minimize the number of non-administrator users with visibility into sensitive entries
Increase audit log review frequency for entries gated by Pending Approval until the upgrade is complete

bash

# Example: query Devolutions Server audit log export for suspicious status changes
# Filter for entry status transitions where the actor is not in the administrators group
grep -E 'EntryStatusChanged' devolutions-audit.log | \
  awk -F'\t' '$5 !~ /Administrator/ {print}'