CVE-2026-93332 Overview
CVE-2026-93332 is an improper access control vulnerability [CWE-862] in the partial connection API of Devolutions Server 2026.3.5.0 and earlier. The flaw allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries through a crafted API request. System Vault entries typically hold privileged secrets used for administrative operations, so unauthorized access breaks the trust boundary between standard users and system-level credential storage.
Critical Impact
Authenticated low-privileged users can fully manipulate System Vault entries, gaining access to secrets intended only for administrators.
Affected Products
- Devolutions Server 2026.3.5.0
- Devolutions Server versions prior to 2026.3.5.0
- Devolutions Server partial connection API component
Discovery Timeline
- 2026-09-29 - CVE-2026-93332 published to NVD
- 2026-09-29 - Last updated in NVD database
- Vendor advisory - Published as Devolutions Security Advisory DEVO-2026-0034
Technical Details for CVE-2026-93332
Vulnerability Analysis
The vulnerability resides in the partial connection API exposed by Devolutions Server. The API endpoint fails to enforce authorization checks that would restrict System Vault operations to privileged users. As a result, any authenticated account, regardless of role or vault assignment, can invoke the API to interact with System Vault entries.
System Vault entries are a distinct storage tier separate from user vaults. They typically contain secrets used by the server itself or by administrative workflows. Improper access control on this tier collapses the privilege separation model that Devolutions Server relies on for multi-tenant secret management.
An attacker with a valid low-privileged account can craft API requests that read existing System Vault entries, insert new entries, modify existing ones, or delete them entirely. This provides paths to credential theft, secret substitution for supply-chain style attacks against downstream systems, and denial of service by removing entries required for server operations.
Root Cause
The root cause is a missing authorization check [CWE-862] in the partial connection API handler. The endpoint validates that the caller is authenticated but does not verify that the caller holds the role or permissions required for System Vault operations. Authentication is treated as sufficient authorization.
Attack Vector
Exploitation requires a valid user account on the Devolutions Server instance. The attacker sends a crafted request to the partial connection API endpoint that references System Vault entries. Because the endpoint skips the authorization check, the server processes the request under the caller's session and returns or modifies the targeted System Vault data. No user interaction beyond the attacker's own authenticated API calls is required.
Refer to the Devolutions Security Advisory DEVO-2026-0034 for vendor technical details. No verified proof-of-concept code is publicly available at this time.
Detection Methods for CVE-2026-93332
Indicators of Compromise
- Unexpected read, create, update, or delete operations against System Vault entries originating from non-administrative user accounts.
- API requests to the partial connection API endpoint that reference System Vault entry identifiers from low-privileged sessions.
- Newly created or modified System Vault entries with authorship attributed to standard users rather than administrators.
Detection Strategies
- Review Devolutions Server audit logs for System Vault operations and correlate the acting user against expected administrative accounts.
- Baseline normal partial connection API usage per user role and alert on deviations, particularly System Vault identifiers referenced by standard users.
- Compare System Vault entry inventories against a known-good snapshot to identify unauthorized additions, modifications, or deletions.
Monitoring Recommendations
- Forward Devolutions Server audit and application logs to a centralized SIEM for retention and correlation.
- Enable alerting on any API call that touches System Vault entries when the source account is not in the administrator group.
- Track authentication events for low-privileged accounts followed by API activity outside their typical vault scope.
How to Mitigate CVE-2026-93332
Immediate Actions Required
- Upgrade Devolutions Server to a version later than 2026.3.5.0 that contains the fix referenced in DEVO-2026-0034.
- Audit all System Vault entries for unauthorized changes and rotate any secrets that may have been exposed.
- Review user account inventory and disable inactive or unnecessary low-privileged accounts.
Patch Information
Devolutions has published fix guidance in Security Advisory DEVO-2026-0034. Administrators should apply the vendor-supplied update that supersedes Devolutions Server 2026.3.5.0. Verify the running version after upgrade and confirm the partial connection API enforces role-based authorization for System Vault operations.
Workarounds
- Restrict network access to the Devolutions Server API to trusted administrative networks until the patch is applied.
- Reduce the number of low-privileged accounts on the server and enforce strong authentication, including multi-factor authentication, for all users.
- Rotate System Vault secrets after patching to invalidate any credentials that may have been read during the exposure window.
# Configuration example
# Verify installed Devolutions Server version on Windows host
Get-ItemProperty "HKLM:\SOFTWARE\Devolutions\Server" | Select-Object Version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
