CVE-2026-13327

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery. The vulnerability can be exploited for privilege escalation and lateral movement.

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters. The vulnerability compromises the confidentiality of stored credentials.

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.

In Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and version 2026.1.23.0 and earlier, improper access control in the PAM password history endpoints allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.

An improper access control vulnerability in the NetBox synchronizer in Devolutions Server. An authenticated user with view-only permission can obtain a stored API token.

An improper access control vulnerability in Devolutions Server allows an authenticated non-administrative user with user-group membership management permission to escalate privileges to administrator via a crafted API request. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier.

In Devolutions Server 2026.1.22.0 and 2026.2.11.0, the Recovery Kit response file generation feature inserts sensitive information into a file. This allows an attacker with access to the generated file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.

An improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request by directly calling the request status endpoint, bypassing the required approver review.

An improper authorization vulnerability in Devolutions Server allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. The issue affects the PAM SSH key and certificate retrieval endpoints.

An improper authorization vulnerability in the secure messages deletion endpoint of Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.