What is GHSA-c4fg-q98q-r57v?

GHSA-c4fg-q98q-r57v is a security advisory published by GitHub Security Advisories with unknown severity. Improper access control in the administrative role assignment endpoint in Devolutions Server 2026...

Which CVE IDs does GHSA-c4fg-q98q-r57v cover?

GHSA-c4fg-q98q-r57v covers the following CVE IDs: CVE-2026-126326. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-c4fg-q98q-r57vunknown

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026...

Vendor

GitHub Security Advisories

Published

November 12, 2026

Last Modified

November 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-126326 →

📋 Description

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-126326
https://devolutions.net/security/advisories/DEVO-2026-0041
https://github.com/advisories/GHSA-c4fg-q98q-r57v