CVE-2026-4064

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.

Score

CVSS 3.1 8.3 High

Status

Analyzed - security@devolutions.net

Published

2026-03-17

Last modified

2026-03-17

Weaknesses

CWE-862

Affected products

• Powershell Universal (Devolutions)
• Powershell Universal (Ironmansoftware)

References

• https://devolutions.net/security/advisories/DEVO-2026-0008