CVE-2026-110804: CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Devolutions Server

This vulnerability involves improper control over the modification of Just-In-Time (JIT) elevation settings within the Privileged Access Management (PAM) checkout feature of Devolutions Server. Authenticated users with PAM checkout access can exploit this flaw by supplying crafted JIT elevation settings in a checkout update request, potentially deleting arbitrary Active Directory groups or maintaining elevated privileges beyond intended limits. The issue affects Devolutions Server versions from initial releases up to but not including 2026.3.10.

An authenticated user with PAM checkout access can abuse this vulnerability to delete arbitrary Active Directory groups, which could disrupt directory services and organizational security policies. Additionally, the user may retain elevated privileges beyond their intended scope, increasing the risk of unauthorized access and privilege escalation within the environment.

A fix is available in Devolutions Server version 2026.3.10. Users should upgrade to this version or later to remediate the vulnerability. No additional mitigation guidance is provided by the vendor advisory.