---
id: CVE-2026-105488
title: >-
  Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and
  earlier allows an authenticated user with only the global vault view
  permission to modify and delete global contact and folder entries.
summary: >-
  Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and
  earlier allows an authenticated user with only the global vault view
  permission to modify and delete global contact and folder entries.
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N'
cwe:
  - CWE-862
vendor: Devolutions
product: Server
affected:
  - Server < 2026.3.8
published: '2026-10-06'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T16:17:33.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-105488'
references:
  - url: 'https://devolutions.net/security/advisories/DEVO-2026-0035/'
    label: security@devolutions.net
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-07T15:17:35.328570Z'
ingestedAt: '2026-10-06T19:13:33.940Z'
epss: 0.00259
epssPercentile: 0.17469
---

## Overview

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.