CVE-2026-9590 Missing authorization in Server
Authenticated users with edit privileges can modify asset information without proper authorization checks in Devolutions Server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9590?
CVE-2026-9590 is a medium-severity missing authorization vulnerability in Devolutions Devolutions Server, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.
Weakness: CWE-284
Which versions are affected by CVE-2026-9590?
It affects 1 product.
Products include Devolutions Devolutions Server.
How do I fix CVE-2026-9590?
No fix has been published for CVE-2026-9590 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-9590 being exploited?
There is no known exploitation of CVE-2026-9590 in the wild and no public exploit code.
Other vulnerabilities in Devolutions Devolutions Server
Sources
Also known as GHSA-3xh5-wf4g-97h5.