CVE-2026-100287
Received Received - Intake

Missing Authorization in Devolutions Server Allows Attachment Deletion

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Devolutions Inc.

Description
Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-100287
EUVD
EUVD-2026-89018

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
devolutions server to 2026.3.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in the attachment history API of Devolutions Server versions 2026.3.5.0 and earlier. An authenticated user with low privileges can exploit this to permanently delete or restore vault attachments by sending a specially crafted API request.

Detection Guidance

This vulnerability involves missing authorization in the attachment history API, allowing low-privileged users to delete or restore vault attachments. To detect it, monitor API logs for unauthorized POST/PUT/DELETE requests to attachment-related endpoints by non-admin users. Check for unexpected changes in attachment states or deletions in audit logs.

Impact Analysis

If you use Devolutions Server 2026.3.5.0 or earlier, a low-privileged attacker with access could delete or restore sensitive vault attachments, potentially leading to data loss or unauthorized access to confidential information.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR or HIPAA by allowing unauthorized deletion or restoration of sensitive data, potentially leading to data breaches or loss of audit trails.

Mitigation Strategies

Update Devolutions Server to a version newer than 2026.3.5.0 to address the missing authorization issue in the attachment history API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart