{"id":"CVE-2026-114487","title":"Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers …","summary":"Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers …","severity":"none","cwe":["CWE-862"],"vendor":"Devolutions","product":"Server","affected":["Server >= 2026.3.5.0 < 2026.3.11","Server < 2026.2.21"],"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T15:48:35.922Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-114487","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0037/"}],"tags":["cve.org"],"ingestedAt":"2026-10-22T22:00:50.341Z","slug":"CVE-2026-114487","body":"## Overview\n\nMissing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request.\n\n## Affected\n\n- `Server >= 2026.3.5.0 < 2026.3.11`\n- `Server < 2026.2.21`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}