Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-15637

Improper authorization in the PAM SSH key and certificate retrieval

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DEVOLUTIONS

Description

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Devolutions Server

Default version status: unaffected

  • 0 to < 2026.1.23affected
  • 0 to < 2026.2.12affected

References