{"id":"CVE-2026-16799","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-16799","generatedAt":"2026-10-28T03:25:18.572Z","title":"Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing…","description":"Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.","published":"2026-07-24T15:17:13.000Z","lastModified":"2026-10-24T13:10:00.000Z","status":"Analyzed","sourceIdentifier":"security@devolutions.net","cvss":{"version":"3.1","score":5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N"},"cwe":["CWE-862"],"affected":["devolutions/powershell universal"],"epss":{"score":0.00254,"percentile":0.16812,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0025/","tags":["Vendor Advisory"],"source":"security@devolutions.net"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-16799","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}