CVEvulnerability

CVE-2026-110804

4.3 MEDIUM Published 2026-10-16 Modified 2026-10-23 Official page ↗
Status
Analyzed
Published
2026-10-16
Last modified
2026-10-23
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-915

Description

Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.

Affected configurations

• devolutions devolutions server (< 2026.2.20.0) • devolutions devolutions server (>= 2026.3.5.0 < 2026.3.10.0)

Related

Weakness · CWE (1)

  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References