What is the CVSS score of CVE-2026-10787?

CVE-2026-10787 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-10787

EUVD-2026-35183 MEDIUM

Missing Authorization (CWE-862)

2026-06-08 DEVOLUTIONS

Authentication Bypass Server

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (DEVOLUTIONS) · only source for this CVE.

CVSS VectorVendor: DEVOLUTIONS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 20:02 vuln.today

CVSS changed

Jun 09, 2026 - 16:22 NVD

4.3 (MEDIUM)

CVE Published

Jun 08, 2026 - 18:26 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request.

This issue affects :

Devolutions Server 2026.2.4.0
Devolutions Server 2026.1.20.0 and earlier

AnalysisAI

Missing authorization on the deleted user groups API in Devolutions Server enables authenticated low-privileged users to enumerate metadata of deleted user groups via crafted API requests, bypassing intended access controls. Affected deployments include versions 2026.2.4.0 and 2026.1.20.0 and earlier, as confirmed by the vendor advisory DEVO-2026-0015. No public exploit exists and CISA SSVC confirms no active exploitation, placing this at low operational priority despite its network-accessible attack vector.

Technical ContextAI

The root cause is CWE-862 (Missing Authorization), a class of flaw where an application fails to enforce access control decisions on a specific API endpoint before executing sensitive operations. In this case, the Devolutions Server deleted user groups API does not verify whether the requesting principal holds the necessary permissions to retrieve group metadata, allowing any authenticated session - regardless of privilege level - to query that endpoint. Devolutions Server (CPE: cpe:2.3:a:devolutions:server) is an enterprise privileged access management and secrets vault platform; its API surface manages sensitive organizational structures including user group definitions. The deleted-groups endpoint is presumably intended for administrative review only, making the missing check a privilege boundary violation. The tag 'Authentication Bypass' from the source intelligence reflects the ability to circumvent the intended authorization boundary, though the attacker still requires a valid low-privileged credential.

RemediationAI

Apply the vendor-released patch per the Devolutions security advisory at https://devolutions.net/security/advisories/DEVO-2026-0015/. The specific fixed release version is not explicitly stated in the available data - patch version not independently confirmed from provided sources; consult the advisory directly for the exact upgrade target. As a compensating control prior to patching, restrict API access to the deleted user groups endpoint at the network perimeter or reverse proxy layer to administrative source IPs only; note this trade-off may break legitimate administrative workflows that access the endpoint remotely. Additionally, audit low-privileged account inventories in Devolutions Server to minimize the number of accounts capable of reaching internal APIs, reducing the pool of potential exploiting principals.