CVE-2026-110804
Medium · 4.3CVSS
4.3
EPSS
0.2%
Published
Oct 16, 2026
CISA due date
—
The record
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119565 Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in… CWE-915
- CVE-2026-114573 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
- CVE-2026-107249 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915
- CVE-2026-90863 Missing authorization in the administrative interface of Progress Software WS_FTP Server… CWE-915
- CVE-2026-118538 A vulnerability was determined in a2ui-project a2ui up to 0.12.0. CWE-915
- CVE-2026-58255 Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. CWE-915
- CVE-2026-115933 Postiz signs its session, invitation and password reset tokens with one shared secret and… CWE-915
- CVE-2026-96378 Improperly Controlled Modification of Dynamically-Determined Object Attributes… CWE-915