Devolutions Server EUVD-2026-102874

Exploitation requires an authenticated Devolutions Server account that has been granted the general Edit permission but specifically lacks the Edit asset permission; the attacker must then issue a crafted direct request to the partial-save endpoint rather than using the normal UI, which enforces the permission. Limiting factors: a valid authenticated session is mandatory (PR:L), the action is confined to modifying an asset contact password (partial integrity impact only, no data disclosure or availability loss), and fixed versions 2026.3.10 and later remove the flaw. There is no user-interaction requirement and no non-default configuration dependency beyond the specific permission split.

All signals converge on this being a LOW real-world priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3 Medium) describes a network-reachable but privilege-dependent flaw with only partial integrity impact and no confidentiality or availability effect. SSVC reinforces this: Exploitation=none (no observed activity), Automatable=no, Technical Impact=partial - a textbook 'Track' rather than 'Act' outcome. There is no CISA KEV listing, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified; the absence of EPSS is a data gap, not a risk indicator. The PR:L requirement means an attacker must already hold an authenticated account with general Edit rights, substantially narrowing the threat population to existing insiders or attackers who have already compromised a limited account. The signals are mutually consistent - there is no CVSS-vs-description conflict here - so this is a genuine low-to-medium authorization weakness suited to routine patching, not an emergency.

An authenticated Devolutions Server user who holds general Edit permission but has NOT been granted the specific Edit asset permission crafts a direct HTTP request to the partial-save endpoint, bypassing the UI's authorization checks to alter an asset contact's password. No public exploit code or active exploitation is known; the low attack complexity (AC:L) means a knowledgeable insider could reproduce it reliably, but it still requires a pre-existing valid account.