CVE-2026-105488

Executive Summary

CVE-2026-105488 is a missing authorization vulnerability in Devolutions Server 2026.3.7.0 and earlier, classified as CWE-862. An authenticated user holding only the global vault "view" permission can modify and delete global contact and folder entries they should not be able to alter. The impact is a horizontal/vertical authorization bypass leading to integrity and availability loss of stored vault data, though confidentiality is not directly affected per the vulnerability's permission model.

Technical Analysis

The vulnerability resides in the "global vault" component of Devolutions Server. The root cause is missing authorization (CWE-862): the application fails to enforce an authorization check on write and delete operations for global contact and folder entries. Authentication alone appears to gate access to these operations, while the requisite permission level ("modify"/"delete") is not validated.

By design, the global vault distinguishes between permission tiers. A "view" permission is intended to be read-only. In affected versions, the authorization logic for modify and delete actions on global contact and folder entries does not enforce this tier separation, so a low-privileged authenticated user with view-only rights can perform state-changing operations.

Key characteristics derivable from the description:

• Attack vector: network, authenticated (requires a valid account with at least the global vault view permission).
• Weakness class: Missing Authorization (CWE-862) — an access control enforcement gap rather than an injection or memory-safety flaw.
• Affected objects: global contact entries and folder entries in the global vault.
• Affected scope: Devolutions Server 2026.3.7.0 and earlier.

The NVD description does not disclose specific API endpoints, parameter names, or function names involved. No code-level identifiers are available; analysis is limited to the vulnerability class and affected object types. These gaps should be treated as areas requiring reverse-engineering against a lab instance for confirmatory detail.

Exploitation Scenarios

No public proof-of-concept or exploit code is available. The attack chain below is inferred at the vulnerability-class level and does not rely on fabricated endpoints or parameters.

1. Reconnaissance / Target Identification An attacker identifies an exposed Devolutions Server instance (e.g., via Shodan queries on the login interface). They establish or obtain a valid low-privileged account that has been granted only the global vault view permission — a common provisioning mistake or a compromised/throwaway credential.

2. Triggering the Flaw Authenticating normally, the attacker uses the application's global vault user interface (or the corresponding authenticated API calls) to reach global contact and folder entries. Because the authorization check for modify and delete actions is missing, the attacker's view-only session is accepted for state-changing operations.

3. Payload / Execution Method At the vulnerability-class level, the attacker submits modify and delete requests against global contact and folder objects. The server performs the operation without validating that the caller holds the modify/delete permission, so the write or delete succeeds. No memory corruption, injection, or privilege escalation primitive is indicated — the flaw is an access control bypass.

4. Post-Exploitation Impact The attacker can alter or remove global contact and folder entries. This corrupts vault organization and potentially disrupts workflows relying on those entries. Integrity of affected records is compromised and availability is reduced through deletion. Confidentiality of content is not the stated impact. An adversary may combine this with social engineering (e.g., altering or deleting contact entries to redirect legitimate users) though such chaining is not stated in the advisory.

Impact Assessment

Because no CVSS score or vector is provided by the source data, the vector below is an analyst-derived estimate consistent with the vulnerability class and must be treated as provisional:

• AV:N (network reachable), AC:L (no special conditions), PR:L (authenticated, low privilege), UI:N (no user interaction), S:U (scope unchanged), C:N (no direct confidentiality impact stated), I:H (arbitrary modification of entries), A:H (deletion of entries).

Business impact:

• Data integrity: Authorized-but-under-privileged users can tamper with global contact and folder metadata, undermining trust in vault contents.
• Availability: Deletion of folders/contacts can disrupt credential retrieval workflows and cause operational downtime.
• Blast radius: The global vault is shared; changes affect all users who rely on its global entries.
• Not affected: No evidence of remote unauthenticated compromise, code execution, or data exfiltration from the description.

Affected systems: Organizations running self-hosted Devolutions Server 2026.3.7.0 and earlier where low-privileged "view" accounts exist.

Detection Guidance

Sigma Rule

title: Devolutions Server Global Vault Unauthorized Modify/Delete Attempts
id: 7b9c7e2a-1f4d-4a9c-9c1e-devolutions-cve2026105488
status: experimental
description: Detects modify or delete operations on global vault contact and folder entries by users lacking modify/delete permissions (CVE-2026-105488).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-105488
author: valtersit.com
date: 2026/01/01
logsource:
  product: Devolutions
  service: server
detection:
  selection_action:
    action:
      - 'GlobalVault.Contact.Update'
      - 'GlobalVault.Contact.Delete'
      - 'GlobalVault.Folder.Update'
      - 'GlobalVault.Folder.Delete'
  selection_result:
    status: 'success'
  condition: selection_action and selection_result
fields:
  - user
  - source_ip
  - action
  - target_id
level: high
falsepositives:
  - Legitimate administrators with modify permissions
tags:
  - attack.t1078
  - cve.2026.105488

YARA Rule

rule CVE_2026_105488_Devolutions_AuthzGap
{
    meta:
        description = "Heuristic detection of Devolutions Server global vault authorization-related request artifacts (CVE-2026-105488)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-105488"
        severity = "high"

    strings:
        $vault = "GlobalVault" ascii wide nocase
        $contact = "GlobalContact" ascii wide nocase
        $folder = "GlobalFolder" ascii wide nocase
        $op_mod = "Modify" ascii wide nocase
        $op_del = "Delete" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        (any of ($vault, $contact, $folder) and any of ($op_mod, $op_del))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-105488 Devolutions Server Global Vault Unauthorized Modify/Delete"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"GlobalVault"; nocase; http.uri; content:"Contact"; nocase; http.request_body; content:"Delete"; nocase; classtype:attempted-user; sid:2026105488; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-105488;)

Elastic Detection

sequence by user.name, source.ip with maxspan=5m
  [ authentication where event.outcome == "success" and user.name != null ]
  [ any where event.action in ("GlobalVault.Contact.Update","GlobalVault.Contact.Delete",
      "GlobalVault.Folder.Update","GlobalVault.Folder.Delete")
      and event.outcome == "success" ]

Splunk SPL Query

index=devolutions sourcetype=devolutions:server
(action="GlobalVault.Contact.Delete" OR action="GlobalVault.Contact.Update"
 OR action="GlobalVault.Folder.Delete" OR action="GlobalVault.Folder.Update")
status="success"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(action) as actions by user, src_ip, target_id
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,cve-2026-105488,">
  <rule id="100488" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">GlobalVault\.(Contact|Folder)\.(Update|Delete)</field>
    <field name="status">success</field>
    <description>CVE-2026-105488: Possible unauthorized global vault contact/folder modification or deletion in Devolutions Server</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>access_control,cve_2026_105488,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Enforce server-side authorization by restricting global vault view-only accounts so they cannot reach modify/delete functionality — implement compensating controls at a reverse proxy or gateway where possible.
• Audit all accounts with global vault view permission; reduce their number and scope.
• Restrict network exposure of the Devolutions Server management interface to trusted networks/VPN.
• Enable verbose audit logging for global vault operations and monitor with the rules above.

2. Patch/upgrade steps

• No vendor patch or fixed version is currently identified by tracked sources. Monitor the Devolutions security advisories channel for a release addressing CVE-2026-105488 and apply it as soon as published.
• Until a fix is available, treat the instance as vulnerable and rely on mitigations above.

3. Long-term hardening

• Centralize and enforce role-based access control with least privilege; separate read vs. write permissions defensively, validating on the server side.
• Adopt automated authorization regression tests for permission tiers.
• Maintain credential hygiene and MFA for Devolutions Server accounts.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-105488
• CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• Devolutions Security Advisories: https://devolutions.net/security/advisories/
• MITRE ATT&CK T1078 Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog (not listed as of data snapshot): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No known threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-105488 based on the provided data.