CVE-2026-15641

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0024/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:devolutions:devolutions_server::::::::
	cpe:2.3:a:devolutions:devolutions_server::::::::

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Autorización indebida en el endpoint de estado de solicitud de acceso en Devolutions Server 2026.2.11, 2026.1.22 permite a un usuario autenticado con privilegios bajos aprobar su propia solicitud de acceso pendiente mediante una llamada directa al endpoint de estado de la solicitud, eludiendo la revisión requerida del aprobador.

Information

Published : 2026-07-14 19:16

Updated : 2026-10-24 21:10

NVD link : CVE-2026-15641

Mitre link : CVE-2026-15641

CVE.ORG link : CVE-2026-15641

JSON object : View

Products Affected

devolutions

devolutions_server

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2026-15641", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15641", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-15T14:41:40.588926Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1.23", "versionType": "custom"}, {"status": "affected", "version": "0", "lessThan": "2026.2.12", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T19:16:51.110", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0024/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review."}, {"lang": "es", "value": "Autorizaci\u00f3n indebida en el endpoint de estado de solicitud de acceso en Devolutions Server 2026.2.11, 2026.1.22 permite a un usuario autenticado con privilegios bajos aprobar su propia solicitud de acceso pendiente mediante una llamada directa al endpoint de estado de la solicitud, eludiendo la revisi\u00f3n requerida del aprobador."}], "lastModified": "2026-10-24T21:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80AEE375-87C0-46A3-9EB3-B41BE6A7000B", "versionEndExcluding": "2026.1.23.0"}, {"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "182ABB43-EBB2-4F52-AF89-E7AB96182C73", "versionEndExcluding": "2026.2.12.0", "versionStartIncluding": "2026.2.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}