CVEvulnerability

CVE-2026-9246

4.3 MEDIUM Published 2026-05-22 Modified 2026-07-23 Official page ↗
Status
Analyzed
Published
2026-05-22
Last modified
2026-07-23
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862

Description

Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

Affected configurations

• devolutions devolutions server (< 2025.3.22.0) • devolutions devolutions server (>= 2026.1.6.0 < 2026.1.19.0)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References