What is the CVSS score of CVE-2026-9248?

CVE-2026-9248 has a CVSS 3.1 base score of 2.6 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9248

EUVD-2026-31454 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-22 DEVOLUTIONS

GHSA-75mg-988w-fm95

Authentication Bypass Hashicorp Server Devolutions

2.6

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

2.6 LOW

AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.1 LOW

Attacker crafts the malicious request themselves so no victim interaction is needed (UI:N); AC:H reflects prerequisite knowledge of cross-vault entry IDs; PR:L for required authenticated write-access account.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:36 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

2.6 (None) 2.6 (LOW)

CVE Published

May 22, 2026 - 15:22 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Cross-vault authorization bypass in Devolutions Server's entry duplication feature permits an authenticated low-privilege user to exfiltrate documentation and attachments from vaults they cannot access by submitting a crafted save request with a foreign entry identifier. Two distinct version ranges are affected: all releases at or before 2025.3.20.0 and the 2026.1.6.0-2026.1.16.0 branch. EPSS stands at 0.03% (7th percentile), SSVC confirms no known exploitation, and no public exploit code has been identified, making this a low-urgency but meaningful finding for organizations relying on strict vault segregation within their PAM environment.

Technical ContextAI

Devolutions Server is an enterprise self-hosted privileged access management (PAM) platform that organizes credentials and sensitive resources into access-controlled vaults. The affected endpoint is the entry duplication (save) feature, which accepts user-controlled entry identifiers to resolve the source object for copying. CWE-639 (Authorization Bypass Through User-Controlled Key) confirms the root cause: the server resolves the source entry by the caller-supplied key without enforcing read-authorization checks against the source vault's access policy, a classic IDOR pattern. The CPE string cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* covers the full Devolutions Server product line. Only documentation and attachments fields are copied - credential secrets are not confirmed to be in scope - but within a PAM context these fields routinely contain sensitive infrastructure details, runbooks, or configuration notes.

RemediationAI

The primary fix is to upgrade Devolutions Server out of the affected version ranges: upgrade from any 2025.3.20.0 or earlier release, or from any 2026.1.6.0-2026.1.16.0 release, to the latest available version per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/. The exact first-fixed version is not stated in the available data and must be confirmed directly with the vendor. If immediate patching is not operationally feasible, restrict vault write permissions to the minimum set of users who legitimately require duplication workflows - this shrinks the pool of users capable of exploitation, though it may disrupt normal vault management operations. As an additional detective control, audit entry duplication and save-request logs for activity referencing entry IDs outside a user's authorized vault scope. If the entry duplication feature is not operationally necessary for any users, disabling it at the server configuration level removes the attack surface entirely until a patch is applied.