CVE-2026-100287

Executive Summary

CVE-2026-100287 is a missing-authorization flaw (CWE-862) in the attachment history API of Devolutions Server 2026.3.5.0 and earlier. An authenticated low-privileged user can craft an API request that permanently deletes or restores vault attachments without holding the authorization required to perform those operations. The flaw carries a CVSS v3.1 base score of 5.4 (Medium), reflecting a network-reachable, low-complexity attack that requires only low privileges and degrades integrity and availability within the affected vault while leaving confidentiality intact.

Technical Analysis

The vulnerability resides in the attachment history API of Devolutions Server, a privileged-access and credential-management platform that centralizes vaulted secrets, credentials, and file attachments. The NVD description states that the component enforces "missing authorization" — that is, a server-side authorization check is absent from the attachment history API path. Per CWE-862 (Missing Authorization), the application authenticates the caller but does not verify that the caller is entitled to perform the requested action against the target resource.

Several characteristics of the flaw can be established directly from the provided data:

• Authentication is required, authorization is not. The attacker must be an authenticated user, but only a low-privileged one. There is no privilege-escalation prerequisite beyond a valid, low-privileged session. This distinguishes the flaw from unauthenticated issues and explains the PR:L subscore.
• The affected operations are destructive and persistence-affecting. The description specifies that the crafted request can "permanently delete or restore vault attachments." Deletion affects integrity and availability; restoration of a previously deleted attachment is also a state-changing integrity event. Both are exposed through the same attachment history API, meaning the missing check governs a resource whose history/revision state should be protected.
• Network-reachable. The vector is AV:N, so the vulnerable API is reachable over the network rather than requiring local access.
• No user interaction. UI:N indicates the operation is completed by the attacker's own request and does not depend on a victim clicking, confirming, or otherwise acting.

The root cause class is straightforward: the attachment history API endpoint does not perform an object-level (per-resource) authorization decision before executing delete/restore actions. Because the NVD description does not enumerate specific endpoints, HTTP methods, request parameters, or handler function names, those implementation specifics are not derivable from the available intelligence and are intentionally not asserted here. No public proof-of-concept, exploit code, or Nuclei template is known, so the attack chain below is described at the vulnerability-class level rather than at the level of a verified request sequence.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (missing authorization in an API-backed destructive operation) and from the facts stated in the NVD description. It intentionally avoids fabricating endpoint paths, HTTP verbs, or parameter names that are not present in the source data.

1. Reconnaissance / target identification. An attacker with any existing low-privileged account on a Devolutions Server instance identifies that vault attachments and their history are exposed through an API. Because the target is typically an internal privileged-access management platform, the attacker most commonly arrives either as a legitimate-but-malicious insider or as an external actor who has already obtained a low-privileged credential (for example via phishing, credential reuse, or a prior foothold). Fingerprinting can be performed passively against a reachable instance using standard HTTP content and certificate attributes.

2. Triggering the flaw class. Using a valid low-privileged session, the attacker sends a crafted request to the attachment history API that targets a vault attachment they are not authorized to modify. The API authenticates the session but omits the authorization check that would normally gate the delete/restore action, and therefore processes the request. The defining condition is the absence of an object-level authorization decision — not the syntax of the request, which the available intelligence does not specify.

3. Payload / execution method (class level). The "payload" is an ordinary, well-formed API call referencing a target attachment within the history subsystem; there is no memory-corruption or injection primitive involved. The bypass is authorization-logic based: the request satisfies authentication and format validation but never satisfies an ownership or role constraint because that constraint is not enforced on this code path. No specific parameter names or request bodies are asserted because none are provided in the NVD description.

4. Post-exploitation impact. Successful abuse lets the low-privileged user permanently delete attachments — including revision history entries — belonging to other users or higher-privileged vaults, or restore previously deleted attachments, thereby altering or reviving sensitive material. Because deletion is described as permanent, recovery may depend entirely on backup integrity, and the manipulation of a secrets-management platform's contents can disrupt dependent systems, obscure evidence relevant to an investigation, or restore artifacts that an administrator intentionally removed. The impact is bounded by the CVSS vector: no confidentiality loss (C:N), low integrity (I:L) and low availability (A:L) impact, scoped to the vulnerable component (S:U).

Impact Assessment

• Affected systems. Devolutions Server 2026.3.5.0 and all earlier versions, in any deployment where the attachment history API is reachable. These are typically internal, self-hosted privileged-access management instances, which places the vulnerability squarely in a high-value control plane.
• CVSS v3.1 interpretation. Base 5.4 (Medium): AV:N (remotely reachable), AC:L (no special conditions), PR:L (authenticated low-privileged user required), UI:N (no victim interaction), S:U (impact confined to the vulnerable component), C:N (no confidentiality impact), I:L (limited integrity impact), A:L (limited availability impact). The combination of low privileges and no user interaction makes the flaw easy to exercise once any low-privileged account exists.
• Blast radius and business impact. The direct blast radius is the vault attachment store and its history. Deleting attachments tied to privileged vaults can interrupt operational workflows, break break-glass or credential-use procedures that depend on attached artifacts, and create availability and audit-integrity problems. Restoring previously deleted attachments can reintroduce sensitive documents that were deliberately purged, undermining data-governance and retention controls. Although the CVSS confidentiality subscore is None, integrity and availability degradation on a secrets-management platform can have outsized downstream consequences because other systems trust it as a source of truth.
• Threat actor relevance. Because exploitation needs only an authenticated low-privileged account, it fits insider-threat and post-compromise scenarios well: an actor who has already obtained any account on the server can use this to tamper with vault contents without needing elevated rights. There is currently no evidence of exploit-in-the-wild activity for this CVE.

Detection Guidance

Because no endpoints, parameters, or request formats are published, the following rules are necessarily class-level and use conservative, tunable logic that must be validated and adjusted against the specific Devolutions Server deployment before production use.

Sigma Rule

title: Devolutions Server Attachment History API Unauthorized Delete or Restore
id: 5f2c9a7e-1d4b-4c8e-9a10-0000cve2026100287
status: experimental
description: Detects low-privileged authenticated requests to the Devolutions Server attachment history API that perform delete or restore operations, consistent with CVE-2026-100287 (CWE-862 missing authorization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100287
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1565
  - attack.t1078
logsource:
  category: webserver
  product: devolutions
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/attachment'
      - '/attachments'
  selection_history:
    cs-uri-stem|contains: 'history'
  selection_action:
    cs-method:
      - 'DELETE'
      - 'POST'
      - 'PUT'
    cs-uri-query|contains:
      - 'delete'
      - 'restore'
  condition: selection_path and selection_history and selection_action
falsepositives:
  - Legitimate administrators performing attachment maintenance
  - Automated retention or cleanup jobs
level: medium

YARA Rule

rule CVE_2026_100287_Devolutions_Attachment_History_Authz
{
    meta:
        description = "Detects references to Devolutions Server attachment history delete/restore activity associated with CVE-2026-100287"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100287"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $api1 = "attachment" ascii nocase
        $api2 = "attachments" ascii nocase
        $api3 = "history" ascii nocase
        $act1 = "delete" ascii nocase
        $act2 = "restore" ascii nocase
        $prompt = "Devolutions" ascii nocase
    condition:
        $prompt and (($api1 or $api2) and $api3) and ($act1 or $act2)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100287 Devolutions Server Attachment History Unauthorized Delete/Restore Attempt"; flow:established,to_server; http.uri; content:"attachment"; nocase; http.uri; content:"history"; nocase; http.method; content:"DELETE"; classtype:attempted-user; reference:cve,2026-100287; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100287; sid:2026100287; rev:1;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ network where http.request.method in ("POST", "PUT", "DELETE")
      and wildcard(http.request.path, "*attachment*history*") ]
  [ network where http.request.method in ("POST", "PUT", "DELETE")
      and wildcard(http.request.path, "*attachment*history*")
      and wildcard(http.request.body.text, "*restore*") ]

Splunk SPL Query

index=web sourcetype=devolutions OR sourcetype=access_combined
| eval uri_path = coalesce(uri_path, cs_uri_stem, url)
| eval method = coalesce(method, cs_method, http_method)
| where (lower(uri_path) LIKE "%attachment%history%")
| where method IN ("DELETE","POST","PUT") OR match(lower(url), "(delete|restore)")
| stats count, values(uri_path) AS paths, values(method) AS methods by src_ip, user, status
| where count > 2
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,web,cve-2026-100287,">
  <rule id="202610287" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">attachment.*history</field>
    <regex field="method">DELETE|POST|PUT</regex>
    <description>CVE-2026-100287: Possible unauthorized attachment history delete/restore on Devolutions Server</description>
    <mitre>
      <id>T1565</id>
    </mitre>
    <group>cve_2026_100287,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; no vendor fix or workaround available).

1. Immediate mitigations (compensating controls, since no vendor fix exists).

   • Restrict network reachability of the Devolutions Server management/API interface to trusted administrative segments; do not expose it to broad internal or any external networks.
   • Enforce least privilege on all accounts: audit for any low-privileged accounts that do not strictly require vault access and disable or downgrade them. Because the flaw requires only a valid low-privileged session, reducing the number of such sessions reduces exposure.
   • Ensure reliable, tested, offline or immutable backups of vault contents and attachment history so that permanent deletions can be recovered; treat the platform as a high-integrity asset.
   • Enable and centralize audit logging for API requests and monitor for anomalous attachment delete/restore activity, especially from accounts that would not normally perform those actions.
   • Where the platform supports it, apply object-level or workflow-level approval controls to attachment and history operations so that destructive actions require broader authorization than a single low-privileged session.

2. Patch/upgrade steps.

   • No patch is currently available per tracked sources. Monitor the Devolutions advisory and release channels for a fixed version and upgrade as soon as one is published. Because the tracked affected range is stated as "2026.3.5.0 and earlier," any fixed release will be at a higher version; confirm the corrected version against the vendor advisory before upgrading. Track the NVD entry (below) and the vendor at devolutions.net for updates.

3. Long-term hardening.

   • Adopt object-level authorization as a mandatory control for every API that reads or mutates vault attachments and history; perform server-side entitlement checks on each request rather than at the UI layer.
   • Apply regression testing for broken-access-control cases (CWE-862/IDOR/privilege boundary) to the platform's API during upgrades.
   • Rotate and tightly scope credentials for any accounts integrated with the vault, and enforce MFA for all interactive logins to reduce the likelihood that an attacker obtains even a low-privileged session.
   • Maintain tamper-evident logging and monitoring of administrative and destructive actions on the vault, with alerting for delete/restore operations outside approved change windows.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100287
• CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• Devolutions (vendor product/advisory channel): https://devolutions.net/security/advisories/
• CISA Known Exploited Vulnerabilities catalog (checked; CVE-2026-100287 is NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• MITRE ATT&CK T1565 (Data Manipulation) and T1078 (Valid Accounts): https://attack.mitre.org/techniques/T1565/ , https://attack.mitre.org/techniques/T1078/

No threat actor campaigns or exploit-in-the-wild evidence are known for this CVE at the time of writing. EPSS has not yet scored this vulnerability (do not assume a value). No public PoC, exploit code, or Nuclei template is available.