Devolutions Server <= 2026.1.21 / 2026.2.0 <= 2026.2.5 Multiple Vulnerabilities (DEVO-2026-0017)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(321522);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/20");

  script_cve_id("CVE-2026-11890", "CVE-2026-12105", "CVE-2026-12117");
  script_xref(name:"IAVB", value:"2026-B-0156");

  script_name(english:"Devolutions Server <= 2026.1.21 / 2026.2.0 <= 2026.2.5 Multiple Vulnerabilities (DEVO-2026-0017)");

  script_set_attribute(attribute:"synopsis", value:
"The Devolutions Server instance installed on the remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Devolutions Server installed on the remote host is prior or equal to 2026.1.21 or 2026.2.0 prior or equal
to 2026.2.5. It is, therefore, affected by multiple vulnerabilities, including:

  - Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows
    an authenticated user to retrieve account discovery scan results. (CVE-2026-11890)

  - Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access
    attachments via folder duplication with inherited permissions. (CVE-2026-12105)

  - Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an
    authenticated vault member to enumerate social login entry metadata to which they are not authorized via
    a crafted API request. (CVE-2026-12117)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://devolutions.net/security/advisories/DEVO-2026-0018/");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Devolutions Server version 2026.1.22 / 2026.2.7 or later.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-12105");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/16");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/16");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/18");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:devolutions:devolutions_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("devolutions_server_win_installed.nbin");
  script_require_keys("installed_sw/Devolutions Server");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
    {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Devolutions Server', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints' : [
        {
          'fixed_version' : '2026.1.22',
          'report'        : {'cves': ['CVE-2026-11890', 'CVE-2026-12105']}
        },{
          'min_version'   : '2026.2',
          'max_version'   : '2026.2.5',
          'fixed_version' : '2026.2.7',
          'report'        : {'cves': ['CVE-2026-11890', 'CVE-2026-12105', 'CVE-2026-12117']}
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);