What is GHSA-mq36-4pv3-66p6?

GHSA-mq36-4pv3-66p6 is a security advisory published by GitHub Security Advisories with Medium severity. Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier...

Which CVE IDs does GHSA-mq36-4pv3-66p6 cover?

GHSA-mq36-4pv3-66p6 covers the following CVE IDs: CVE-2026-110287. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mq36-4pv3-66p6?

GHSA-mq36-4pv3-66p6 has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

GHSA-mq36-4pv3-66p6MediumCVSS 4.3

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier...

Vendor

GitHub Security Advisories

Published

October 16, 2026

Last Modified

October 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-110287 →

📋 Description

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110287
https://devolutions.net/security/advisories/DEVO-2026-0036
https://github.com/advisories/GHSA-mq36-4pv3-66p6