MEDIUM 4.3 NVD

CVE-2026-110287

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit a

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

References

https://devolutions.net/security/advisories/DEVO-2026-0036/

Published: 2026-10-16 · Source: NVD · Feed updated: 2026-10-16

This medium severity vulnerability with a CVSS score of 4.3 was published on 2026-10-16 via NVD.

vulnfeed aggregates 16278 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.