GCVE-110-NCSC-2026-475

Advisory PublishedCVSS 7.7/10

Vulnetix · Advisory published November 10, 2026

An authorization bypass vulnerability in Azure DevOps Server allows an authorized attacker to elevate privileges over a network by exploiting a user-controlled key.

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyCWE-78Improper Neutralization of Special Elements used in an OS CommandCWE-426Untrusted Search PathCWE-732Incorrect Permission Assignment for Critical ResourceCWE-299Improper Check for Certificate RevocationCWE-918Server-Side Request ForgeryCWE-862Missing AuthorizationCWE-22Improper Limitation of a Pathname to a Restricted DirectoryCWE-77Improper Neutralization of Special Elements used in a CommandCWE-306Missing Authentication for Critical FunctionalityCWE-1390Weak Authentication

Risk Scores

CVSS 3.1

7.7/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N/E:U/RL:O/RC:C

Affected Products

Vendor	Product	Versions	Platforms
Microsoft	vers:unknown/*	—	—

Aliases

CVE-2026-102224 CVE-2026-105494 CVE-2026-105734 CVE-2026-109457 CVE-2026-109462 CVE-2026-109467 CVE-2026-112745 CVE-2026-113822 CVE-2026-113823 CVE-2026-114160 CVE-2026-114161 CVE-2026-118288 CVE-2026-118742 CVE-2026-119989 CVE-2026-119990 CVE-2026-120783 CVE-2026-121668 CVE-2026-122986 CVE-2026-85923

References

advisory

Browse GCVE Records

851 records in the GCVE database · Updated November 12, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON