CVE-2026-102632
Last modified
CVE-2026-102632 is a vulnerability of currently unknown severity. Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state..
Description
Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | PowerShell Universal | < 2026.3.5 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-102632?
How severe is CVE-2026-102632?
How do I fix CVE-2026-102632?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-102626An authenticated LimeSurvey Community Edition 7.4.0 user wit…7.2
- CVE-2026-102627IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could a…8.8
- CVE-2026-102628The Cadmos LTI application hosted at cadmos.eummena.io had L…9.3
- CVE-2026-10263A vulnerability was found in SourceCodester Computer Repair …7.3
- CVE-2026-102630UnoPim versions before 2.0.1 and 2.1.1 trust all connecting …4.7
- CVE-2026-102631In authd before 0.7.1, the user identity matching in UpdateU…5.9
- CVE-2026-102633libexpat versions 2.7.2 through 2.8.5 contain an integer ove…5.9
- CVE-2026-102634SGLang through 0.5.20 in prefill/decode disaggregation mode …7.5
- CVE-2026-102635ImageMagick versions before 7.1.2-32 and 6.9.13-57 contain u…5.3
- CVE-2026-102636A maliciously crafted HTML payload in a design name, when di…7.1
- CVE-2026-102637A maliciously crafted HTML payload in the documentName param…7.1
- CVE-2026-102638A maliciously crafted HTML payload in the description of an …7.1
Are you affected by CVE-2026-102632?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST