Improper Access Control in Devolutions Server

Executive Summary

CVE-2026-11890 is a security vulnerability in Devolutions Server versions 2026.2.5 and earlier, as well as 2026.1.21 and earlier. It involves improper access control in the PAM (Privileged Access Management) account discovery results feature. This flaw allows an authenticated user to retrieve account discovery scan results that they should not be authorized to access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing an authenticated user to access sensitive account discovery scan results without proper authorization. This could lead to unauthorized exposure of privileged account information, potentially enabling further attacks or misuse of privileged credentials.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your Devolutions Server to version 2026.2.7 or 2026.1.22 or later.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an authenticated user to retrieve account discovery scan results without proper authorization due to improper access control. This unauthorized access to potentially sensitive account information could lead to non-compliance with standards and regulations such as GDPR and HIPAA, which require strict controls on access to sensitive data.

However, specific impacts on compliance with these standards are not detailed in the provided information.

Useful 0 Not Useful 0