Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and…

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.

Etkilenen sürümler1 yazılım

Kaynaklar3 kaynak

• CVE.org kaydı
• NVD kaydı
• devolutions.net/security/advisories/DEVO-2026-0037 Diğer

Kayıt geçmişi

1. 30 Eki 2026 22:40CVSS puanı değişti: – → 4.3
2. 22 Eki 2026 18:48Yayımlandı

İlgili açıklar

• 4,3 CVE-2026-114486Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier al…
• 4,3 CVE-2026-114485Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and ear…
• 6,5 CVE-2026-103997Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via…
• 4,3 CVE-2025-11455Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement
• 5,9 CVE-2026-110023WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter
• 5,3 CVE-2026-11396Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter