CVE-2026-17568
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
27/07/2026
Last modified:
27/07/2026
Description
Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request.<br />
<br />
This issue affects :<br />
<br />
* Devolutions Server 2026.2.4.0 through 2026.2.12.0<br />
* Devolutions Server 2026.1.23.0 and earlier