CVE-2026-110806: CWE-863 Incorrect Authorization in Devolutions Server
Description
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
CVSS v3.1
Score 6.5medium
Affected software
Devolutions
Server
pkg:github/devolutions/serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CWE-863) in Devolutions Server affects versions prior to 2026.3.10. An authenticated user granted only View permission can retrieve add-on passwords because the server returns unredacted add-on properties in connection data. This represents an authorization bypass where insufficient access control allows exposure of sensitive password data to unauthorized users.
Potential Impact
An attacker with valid user credentials but limited permissions (View only) can obtain sensitive add-on passwords, potentially leading to unauthorized access to systems or services protected by those credentials. This compromises confidentiality of sensitive information within the affected Devolutions Server environment.
Mitigation Recommendations
A fix is available in Devolutions Server version 2026.3.10. Users should upgrade to this version or later to remediate the vulnerability. Until patched, restrict access to trusted users only and monitor for unauthorized access attempts. Patch status is confirmed by the affectedVersions field indicating fixed in 2026.3.10.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- DEVOLUTIONS
- Date Reserved
- 2026-10-14T18:06:43.626Z
- State
- PUBLISHED
Threat ID: 6ad22ed92cdf04f656f50f0c
Added to database: 10/16/2026, 14:04:09 UTC
Last enriched: 10/16/2026, 14:18:23 UTC
Last updated: 10/16/2026, 15:19:18 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.