CVE-2026-16799

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

CVSS v3 5.0 MEDIUM

5.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0025/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Control de acceso inadecuado en las características de pruebas de automatización y flujos de trabajo en Devolutions PowerShell Universal 2026.2.2 y versiones anteriores permite a un usuario autenticado con solo el rol de Lector ejecutar pruebas de automatización y modificar propiedades de flujos de trabajo debido a la falta de comprobaciones de autorización del lado del servidor.

Information

Published : 2026-07-24 15:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-16799

Mitre link : CVE-2026-16799

CVE.ORG link : CVE-2026-16799

JSON object : View

Products Affected

devolutions

powershell_universal

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-16799", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16799", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T17:46:45.423093Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.0, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.1}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "PowerShell Universal", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-24T15:17:12.857", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0025/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks."}, {"lang": "es", "value": "Control de acceso inadecuado en las caracter\u00edsticas de pruebas de automatizaci\u00f3n y flujos de trabajo en Devolutions PowerShell Universal 2026.2.2 y versiones anteriores permite a un usuario autenticado con solo el rol de Lector ejecutar pruebas de automatizaci\u00f3n y modificar propiedades de flujos de trabajo debido a la falta de comprobaciones de autorizaci\u00f3n del lado del servidor."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "901C92C3-006F-4833-8D7E-DFE0B8A9E60E", "versionEndExcluding": "2026.2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}