Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view… (CVE-2026-105488)

CVE-2026-105488 describes a missing authorization control in Devolutions Server up to version 2026.3.7.0. This flaw permits an authenticated user who has only the global vault view permission to escalate their privileges and perform unauthorized modifications and deletions of global contact and folder entries within the global vault.

The vulnerability allows unauthorized modification and deletion of global vault data by users who should only have view access. This can lead to data integrity issues and potential disruption of operations relying on the global vault. The CVSS 3.1 score is 7.1 (high), reflecting low attack complexity but requiring some privileges (authenticated user with view permission). Confidentiality impact is low, integrity impact is high, and availability impact is none.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users who require global vault view permissions and monitor for suspicious activity related to global vault modifications.