CVE-2026-110287

MediumCVSS 4.3/10Last modified Oct 23, 2026

Description

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Devolutions	Server	< 2026.3.10

References

https://devolutions.net/security/advisories/DEVO-2026-0036/Vendor Advisory

Timeline

Published: Oct 16, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1102885.3A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete sto CVE-2026-1102895.5A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and CVE-2026-110299.6Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who CVE-2026-1102906.4The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to CVE-2026-1102917.2The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'iq_tree_chart_node CVE-2026-1102926.5The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in CVE-2026-11035.4The AIKTP plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the /aiktp/getToken CVE-2026-110308.8Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via malic CVE-2026-1103057.5The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi CVE-2026-1103066.1fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4 CVE-2026-1103098.8IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of c CVE-2026-110314.3Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform