CVE-2026-12105: Devolutions Server Improper Access Control Allows Unauthorized Attachment Disclosure

Technical summary

CVE-2026-12105 is classified as an improper access control vulnerability (CWE-862) affecting Devolutions Server versions 2026.2.5 and 2026.1.21. The flaw stems from insufficient permission validation during folder duplication operations. When a folder is cloned, inherited permissions are applied without properly restricting access to attachments within that folder structure. An authenticated user can navigate the duplication feature to gain unintended visibility into confidential attachments. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the requirement for valid authentication and the confidentiality impact, with no integrity or availability compromise.

Business impact

This vulnerability creates a compliance and data governance risk for organizations using Devolutions Server as a secrets and credential management platform. Employees or contractors with basic authentication access could uncover sensitive attachments—potentially including passwords, API keys, certificates, or documentation—that should remain restricted by role or department. In regulated environments (finance, healthcare, government), this unauthorized disclosure could trigger audit findings and data breach notifications depending on the content and scope of exposure. The impact is primarily confidentiality-driven rather than destructive, but the damage extends to trust and operational security assumptions.

Affected systems

Devolutions Server versions 2026.2.5 and 2026.1.21 are confirmed vulnerable. Organizations running these specific releases should prioritize assessment. Verify your deployment version in Devolutions Server's admin console or via the Help > About menu. Versions outside this range have not been confirmed affected by this particular flaw, but check Devolutions' official advisory for a complete patch timeline and whether earlier or later versions require updates.

Exploitability

Exploitation requires valid Devolutions Server credentials—no unauthenticated attack path exists. The technical barrier is low: an attacker leverages the standard folder duplication feature available in the UI, making it easily discoverable during normal system exploration. There is no known public exploit code, and the issue is not listed on the CISA KEV (Known Exploited Vulnerabilities) catalog, suggesting limited wild exploitation as of the publication date. However, the simplicity of the attack vector means insider threat or compromised account scenarios are realistic.

Remediation

Devolutions has released patched versions addressing this access control defect. Organizations should update Devolutions Server to a version newer than 2026.2.5 and 2026.1.21 as soon as practical. Consult the official Devolutions security advisory or release notes to confirm the specific patched version for your deployment track. Interim mitigations—such as restricting folder duplication permissions to administrators only—may reduce risk, but are not a substitute for patching.

Patch guidance

Contact Devolutions support or review the official security advisory at Devolutions' website for the exact patched version numbers and release dates. Plan a maintenance window to update Devolutions Server, ensuring you back up your configuration and database beforehand. Test the patch in a non-production environment first to confirm no integration issues with connected clients or workflows. After patching, conduct a post-update audit to verify folder permission inheritance is properly enforced.

Detection guidance

Monitor Devolutions Server audit logs for unusual folder duplication activity, especially by users who do not normally perform administrative operations. Look for patterns of rapid folder cloning followed by attachment access from accounts with limited expected permissions. Review access control policies and test permission inheritance manually: duplicate a restricted folder and verify that inherited permissions are genuinely limiting access as intended. Network-based detection is limited since this is an authorization flaw within the application; focus on server-side event logging and periodic permission audits.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), the priority should be elevated above raw score alone because Devolutions Server is a sensitive asset—it holds passwords, secrets, and credentials for critical infrastructure. Unauthorized attachment disclosure within such a system is particularly damaging to operational security posture. The simplicity of exploitation (folder duplication via standard UI) and the insider/compromised-account threat vectors make this a practical risk. Organizations should treat this as HIGH priority for patching, particularly if they have evidence of unusual duplication activity or strict data governance requirements.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability requiring low attack complexity and valid authentication (PR:L), resulting in high confidentiality impact (C:H) but no integrity or availability loss (I:N, A:N). The score appropriately captures the access control flaw's severity. However, context matters: Devolutions Server's role as a privileged credential store elevates business risk beyond the numerical score, and insider/compromised-credential scenarios are more probable than typical enterprise vulnerabilities. Use the 6.5 score as a baseline, not a ceiling, for remediation urgency.

Frequently asked questions