CVE-2026-17568

HighCVSS 8.8/10Last modified Oct 24, 2026

Description

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request.

This issue affects :

* Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
Devolutions	Server	< 2026.1.24; >= 2026.2.4.0, < 2026.2.14

References

https://devolutions.net/security/advisories/DEVO-2026-0026/Vendor Advisory

Timeline

Published: Jul 27, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-175694.3Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry CVE-2026-17576.2A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is CVE-2026-175704.3Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose CVE-2026-175716.1The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected C CVE-2026-175725.5Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a de CVE-2026-175735.5A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via CVE-2026-175745.5HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-leng CVE-2026-175766.5The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13 CVE-2026-175776.1The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, an CVE-2026-175782.3Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limi CVE-2026-17588.3Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 1 CVE-2026-175806.5The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…