CVE-2026-16799 | Improper access control in the automation tests and workflow… | CVSS 5.0 MEDIUM

Description

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

Metadata

CVE ID: CVE-2026-16799
State: PUBLISHED
Assigner: DEVOLUTIONS
Reserved: 2026-07-23 19:24 UTC
Published: 2026-07-24 14:53 UTC
Last updated: 2026-07-24 17:47 UTC
Primary CWE: CWE-862
CWE-862: Missing Authorization
Vendor / Product: Devolutions / PowerShell Universal
Sources: cve.org · NVD

Severity & Metrics

5.0 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

SSVC — CISA Coordinator

Exploitation: none
Automatable: no
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Devolutions	PowerShell Universal	—	0 < 2026.2.3

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	CWE-862: Missing Authorization

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.0	MEDIUM	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0025/