CVE-2026-9248
LowCVSS 2.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, authorization bypass in the entry duplication feature allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.
Risk Assessment
An authenticated user can access sensitive data in vaults they are not authorized to access, violating access control.
Recommendation
Update Devolutions Server to a version above 2026.1.16.0 that includes the fix. Review permissions for entry duplication.
Original NVD description (English source)
Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier