EUVD-2026-31461
GHSA-vp8v-33p7-8977
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Independently assessed C:L because sealed entry sensitive data is retrieved by the attacker, which the vendor's C:N omits; PR:H retained as high-privileged authentication is required.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request.
This issue affects :
- Devolutions Server 2026.1.6.0 through 2026.1.16.0
- Devolutions Server 2025.3.20.0 and earlier
AnalysisAI
Sealed-entry audit bypass in Devolutions Server allows an authenticated high-privileged user to silently retrieve sensitive data from protected vault entries without generating the expected unseal audit notification, undermining privileged access oversight controls. Affected versions span all releases through 2025.3.20.0 and the 2026.1.6.0 to 2026.1.16.0 range. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the compliance and insider-threat implications are significant in PAM environments where sealed-entry audit trails are the primary detection mechanism for sensitive credential access.
Technical ContextAI
Devolutions Server is an enterprise Privileged Access Management (PAM) platform. Its sealed-entry feature is a workflow-enforced control that requires an auditable unseal event before sensitive data within a vault entry can be accessed - functioning as a deterrent and detection mechanism for insider access to high-value credentials. The vulnerability is classified as CWE-841 (Improper Enforcement of Behavioral Workflow), which occurs when an application fails to enforce the mandated sequence of steps in a business process. Here, the API endpoint responsible for sensitive-data retrieval does not consistently verify that the sealed-entry workflow (and its accompanying audit notification) has been correctly initiated, allowing a crafted API request to short-circuit the workflow and return sensitive data without logging the unseal event. The affected product is identified via CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*.
RemediationAI
Patch available per vendor advisory - consult https://devolutions.net/security/advisories/DEVO-2026-0013/ for the confirmed fixed version(s) and upgrade accordingly; for the 2026.1.x branch this means upgrading beyond 2026.1.16.0, and for the 2025.3.x branch upgrading beyond 2025.3.20.0. Exact fixed release identifiers are not confirmed in available input data and must be verified from the advisory before deploying. As a compensating control where immediate patching is not feasible, implement SIEM correlation rules to detect API-level access to sealed-entry data endpoints that are not accompanied by a corresponding unseal audit event in Devolutions Server logs; discrepancies would indicate potential exploitation. Restricting API access to Devolutions Server from trusted networks or service account IP ranges reduces exposure but does not eliminate the vulnerability for already-authenticated users with entry access. Note that neither compensating control eliminates the root flaw - patching remains the definitive remediation.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today