CVE-2026-9251

In Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and version 2026.1.23.0 and earlier, improper access control in the PAM password history endpoints allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.

An improper access control vulnerability in the NetBox synchronizer in Devolutions Server. An authenticated user with view-only permission can obtain a stored API token.

An improper access control vulnerability in Devolutions Server allows an authenticated non-administrative user with user-group membership management permission to escalate privileges to administrator via a crafted API request. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier.

In Devolutions Server 2026.1.22.0 and 2026.2.11.0, the Recovery Kit response file generation feature inserts sensitive information into a file. This allows an attacker with access to the generated file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.

An improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request by directly calling the request status endpoint, bypassing the required approver review.

An improper authorization vulnerability in Devolutions Server allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. The issue affects the PAM SSH key and certificate retrieval endpoints.

An improper authorization vulnerability in the secure messages deletion endpoint of Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.

In Devolutions Server 2026.2.9.0, improper enforcement of a mandatory multi-factor authentication (MFA) policy was found. An attacker with valid user credentials can bypass the MFA Required policy and authenticate without completing multi-factor authentication. The issue occurs when DVLS encounters an invalid default MFA value.

A vulnerability in Devolutions Server versions 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host. By crafting a DomainName parameter in the PAM AD discovery endpoints, the attacker can capture PAM provider credentials as an NTLMv2 challenge-response.

In Devolutions Server 2026.2.5, improper access control in the social login connection endpoint allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized.