CVE-2026-105488

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-07

Assigner: Devolutions Inc.

Description

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-105488

EUVD

EUVD-2026-93783

Affected Vendors & Products

Vendor	Product	Version / Range
Devolutions	Server	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

Missing authorization in the global vault of Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only global vault view permission to modify or delete global contact and folder entries.

Detection Guidance

To detect this vulnerability, check Devolutions Server versions for 2026.3.7.0 or earlier. Review audit logs for unauthorized modifications or deletions in the global vault by users with only view permissions. Ensure no unexpected changes to global contacts or folders occurred.

Impact Analysis

An attacker with limited access could alter or remove critical global contacts or folders, potentially disrupting operations or causing data loss in the Devolutions Server environment.

Compliance Impact

The vulnerability allows unauthorized modification and deletion of global contact and folder entries in the vault by an authenticated user with only view permissions. This could lead to unauthorized changes in sensitive data storage, potentially violating compliance requirements for data integrity and access control in standards like GDPR and HIPAA.

Mitigation Strategies

Update Devolutions Server to a version later than 2026.3.7.0 to address the missing authorization issue in the global vault.

Hi! I’m here to help you understand CVE-2026-105488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70