CVE-2026-9248CWE-639

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation…

Low · published May 22, 2026

CVSS v3.1
2.6
EPSS
0%
Percentile
10.3
In the wild
Unconfirmed
What it is

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.

This issue affects :

* Devolutions Server 2026.1.6.0 through 2026.1.16.0

* Devolutions Server 2025.3.20.0 and earlier

The record
Technical detail
CVSS v3.1
2.6 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00207 · 10.3th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-05-22T15:22Z
EPSS history
Timeline
  • 22 MAY 15:22Z
    Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation…
    cvelistv5