CVE-2026-102632

Not scored yetLast modified Nov 13, 2026

Description

Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.

Metrics

No CVSS score has been published yet.

Weakness enumeration

CWE-266

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 13, 2026
Last modified
Nov 13, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-1026335.9libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computiCVE-2026-1026347.5SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with MooCVE-2026-1026355.3ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain uninitialized heap memory disclosure in the GIF decoder's application extension hCVE-2026-1026367.1A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored CrCVE-2026-1026377.1A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can tCVE-2026-1026387.1A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the CVE-2026-1026396.5MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic tCVE-2026-102643.5A vulnerability was determined in lharries whatsapp-mcp 0.0.1. Affected by this vulnerability is the function SendMessageRequest of the fileCVE-2026-1026438.8AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asynCVE-2026-1026499.9Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator. Prior to 0.13.0, `POST /api/webhook` accepts unsigned CVE-2026-102656.3A vulnerability was identified in itsourcecode Content Management System 1.0. Affected by this issue is some unknown functionality of the fiCVE-2026-1026507.5Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticat
CVE-2026-102632: Unscored | Vulnix