Vulnerability · Published May 22, 2026 · Assigned by DEVOLUTIONS
CVE-2026-9246
Medium 4.3
In plain English
A medium-severity missing authorization in Server from Devolutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).
Official description
Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Server | 2026.1.6.0 – through 2026.1.16.00 – through 2025.3.20.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N