CVE-2026-9223

Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.

Score

CVSS 3.1 4.3 Medium

Status

Analyzed - security@devolutions.net

Published

2026-05-22

Last modified

2026-05-22

Weaknesses

CWE-284

Affected products

• Devolutions Server (Devolutions)
• Server (Devolutions)

References

• https://devolutions.net/security/advisories/DEVO-2026-0013/