EUVD-2026-31463
GHSA-9336-f49m-568v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network-accessible exploitation requires a low-privilege authenticated session (PR:L); limited C:L and I:L reflect unauthorized data read and approval state manipulation with no availability impact.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request.
This issue affects :
- Devolutions Server 2026.1.6.0 through 2026.1.16.0
- Devolutions Server 2025.3.20.0 and earlier
AnalysisAI
Authorization bypass in Devolutions Server's entry status management feature allows authenticated non-administrator users to circumvent an administrator-enforced Pending Approval workflow, gaining unauthorized access to protected entry data through a crafted status change request. Affected versions span the entire 2025.3.x line through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 to 2026.1.16.0, as confirmed by Devolutions advisory DEVO-2026-0013. No public exploit has been identified and EPSS sits at 0.03% (7th percentile), indicating negligible observed exploitation activity; SSVC corroborates no known exploitation at time of analysis.
Technical ContextAI
CWE-862 (Missing Authorization) describes a failure to perform a server-side authorization check for a privileged operation, allowing users to perform actions beyond their granted role. In this case, the entry status management API within Devolutions Server - a privileged access management and password vault platform - does not enforce the required administrative authorization when processing status change requests. The Pending Approval flow is a security control allowing administrators to gate user access to sensitive vault entries pending explicit approval; the missing check means a low-privilege authenticated user can alter an entry's approval status directly, bypassing the gate. The CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* covers all Devolutions Server application variants across both affected version branches.
RemediationAI
Upgrade Devolutions Server to a version beyond 2026.1.16.0 on the 2026.1.x track; customers on the 2025.3.x branch should also upgrade to a fixed release. The exact fixed version should be confirmed directly against the Devolutions security advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/ as no explicit target version was identified in the available intelligence. As a compensating control where immediate patching is not feasible, restrict the set of non-administrator users who can submit status change requests at the application permission layer, and audit existing vault entry approval configurations to identify any entries whose Pending Approval status may have been manipulated. Note that disabling the Pending Approval workflow entirely removes the exploited feature but also eliminates an intended access control mechanism and may increase risk to sensitive entries.
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Audit log integrity across all Bitwarden Server organizations can be undermined by any authenticated user, who may injec
In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" paramet
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today