{"id":"CVE-2026-16799","state":"PUBLISHED","title":"Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader ro","description":"Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.","publishedAt":"2026-07-24T14:53:33.439Z","updatedAt":"2026-07-24T17:47:16.710Z","severity":{"score":5,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions PowerShell Universal"],"affected":[{"vendor":"Devolutions","product":"PowerShell Universal","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.2.3","versionType":"custom"}]}],"references":["https://devolutions.net/security/advisories/DEVO-2026-0025/"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/16xxx/CVE-2026-16799.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-16799","state":"PUBLISHED","datePublished":"2026-07-24T14:53:33.439Z","dateUpdated":"2026-07-24T17:47:16.710Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2026-07-23T19:24:53.307Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks."}],"affected":[{"vendor":"Devolutions","product":"PowerShell Universal","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"2026.2.3","versionType":"custom"}]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0025/"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","lang":"en","description":"CWE-862: Missing Authorization","type":"CWE"}]}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2026-07-24T14:53:33.439Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"CHANGED","version":"3.1","baseScore":5,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N","integrityImpact":"LOW","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"NONE"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-07-24T17:46:45.423093Z","id":"CVE-2026-16799","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-07-24T17:47:16.710Z"}}]}}}