What is the CVSS score of CVE-2026-12105?

CVE-2026-12105 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-12105?

Yes, a patch is available for CVE-2026-12105. Update the affected software to the latest version immediately.

Devolutions Server CVE-2026-12105

EUVD-2026-37203 MEDIUM

Missing Authorization (CWE-862)

2026-06-16 DEVOLUTIONS

GHSA-pv8r-8r75-69wf

Authentication Bypass Devolutions Server Devolutions

6.5

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Network-accessible PAM web app; low-privilege authenticated account sufficient; no integrity or availability impact from attachment read-only bypass.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:37 vuln.today

Patch available

Jun 16, 2026 - 21:02 EUVD

CVE Published

Jun 16, 2026 - 18:28 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.

AnalysisAI

Improper access control in Devolutions Server allows authenticated low-privilege users to read restricted attachments by exploiting a folder duplication feature that incorrectly inherits permissions without re-validating authorization on the duplicated content. Versions prior to 2026.1.21 (1.x branch) and 2026.2.5 (2.x branch) are confirmed affected per the vendor advisory DEVO-2026-0017. Exploitation requires an existing authenticated account; no public exploit exists and SSVC assessment indicates no active exploitation, making this a medium-priority remediation rather than an emergency response.

Technical ContextAI

Devolutions Server is an enterprise privileged access management (PAM) and password vault platform commonly deployed in mid-to-large organizations to store credentials, secrets, and sensitive file attachments. The vulnerability is rooted in CWE-862 (Missing Authorization): when a user duplicates a folder, the server propagates inherited permissions to the new folder structure but fails to enforce an authorization check on the underlying attachments accessible through that duplicated path. This allows the authenticated user to traverse to attachment objects they would otherwise be denied access to. The affected CPE is cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*, covering all sub-versions below the two patched releases across active maintenance branches.

RemediationAI

Upgrade Devolutions Server to version 2026.1.21 or later on the 1.x branch, or to 2026.2.5 or later on the 2.x branch, as confirmed by vendor advisory DEVO-2026-0017 at https://devolutions.net/security/advisories/DEVO-2026-0017/. If immediate upgrade is not possible, administrators should audit and restrict the 'folder duplication' feature to only trusted, high-privilege roles via Devolutions Server role-based access control settings, which reduces exposure at the cost of limiting a legitimate collaboration workflow. Additionally, reviewing audit logs for unexpected folder duplication events by low-privilege accounts can help detect any prior exploitation. No compensating control fully replaces the patch given the nature of the access control bypass.