CVE-2026-110287: Server 0 to before 2026.3.10

Affected technology

Server · 0 to before 2026.3.10
Devolutions

Description’s affected range: 2026.3.8.0 and earlier

Component: Not specified by the source

What an attacker can do

An authenticated user with general Edit but without Edit asset permission can modify the asset contact password via a crafted direct request to the partial-save endpoint.