{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17568", "assignerOrgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", "state": "PUBLISHED", "assignerShortName": "DEVOLUTIONS", "dateReserved": "2026-07-27T15:01:44.756Z", "datePublished": "2026-07-27T17:36:57.462Z", "dateUpdated": "2026-07-27T17:36:57.462Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "bfee16bd-18e6-446c-9a65-f5b2e3d89c23", "shortName": "DEVOLUTIONS", "dateUpdated": "2026-07-27T17:36:57.462Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 Incorrect Authorization", "type": "CWE"}]}], "affected": [{"vendor": "Devolutions", "product": "Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1.24", "versionType": "custom"}, {"status": "affected", "version": "2026.2.4.0", "lessThan": "2026.2.14", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request.\n\nThis issue affects :\n\n * Devolutions Server 2026.2.4.0 through 2026.2.12.0\n * Devolutions Server 2026.1.23.0 and earlier", "supportingMedia": [{"type": "text/html", "base64": false, "value": "Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request.<p>This issue affects :</p><ul><li>Devolutions Server 2026.2.4.0 through 2026.2.12.0</li><li>Devolutions Server 2026.1.23.0 and earlier</li></ul>"}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0026/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}}}

{}

{}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.1.24)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2026.2.4.0,2026.2.14)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Server", "source": "cna", "vendor": "Devolutions"}, "product": "server", "vendor": "devolutions"}], "created": "2026-07-28T01:30:03.280161+00:00", "updated": "2026-07-28T01:30:03.280186+00:00", "vendors": ["devolutions", "devolutions$PRODUCT$server"]}