Devolutions Server vulnerabilities

CVE-2023-5575 [MEDIUM] CVE-2023-5575: Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlie Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via a specific combination of permissions in the entry and in its parent.

CVE-2023-0661 [MEDIUM] CWE-284 CVE-2023-0661: Improper access control in Devolutions Server allows an authenticated user to access unauthorized se Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.

CVE-2024-12196 [MEDIUM] CWE-863 CVE-2024-12196: Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier all Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the view password permission.

CVE-2022-3781 [MEDIUM] CWE-311 CVE-2022-3781: Dashlane password and Keepass Server password in My Account Settings are not encrypted in the datab Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions

CVE-2025-2278 [MEDIUM] CWE-284 CVE-2025-2278: Improper access control in temporary access requests and checkout requests endpoints in Devolutions Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.

CVE-2024-6512 [MEDIUM] CWE-863 CVE-2024-6512: Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 an Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to approve their own requests, bypassing intended security restrictions, via the PAM access request approval mechanism.

CVE-2025-3517 [MEDIUM] CWE-266 CVE-2025-3517: Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and ear Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.

CVE-2026-3638 [MEDIUM] CWE-862 CVE-2026-3638: Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.

CVE-2021-23924 [HIGH] CWE-532 CVE-2021-23924: An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive infor An issue was discovered in Devolutions Server before 2020.3. There is an exposure of sensitive information in diagnostic files.

CVE-2025-4493 [MEDIUM] CWE-266 CVE-2025-4493: Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by exploiting a user interface issue. This issue affects the following versions : * Devolutions Server 2025.1.3.0 through 2025.1.7.0 * Devolutions Server 2024.3.15.0 and earlier

CVE-2026-4927 [MEDIUM] CWE-201 CVE-2026-4927: Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with u Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.

CVE-2023-1201 [MEDIUM] CVE-2023-1201: Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below all Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that possesses the message UUID to access the data it contains.

CVE-2023-0952 [MEDIUM] CWE-863 CVE-2023-0952: Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an auth Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper authorization.

CVE-2023-1603 [MEDIUM] CWE-863 CVE-2023-1603: Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 202 Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry permission via id collision.

CVE-2026-4829 [MEDIUM] CWE-287 CVE-2026-4829: Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 an Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.

CVE-2025-5382 [MEDIUM] CWE-284 CVE-2025-5382: Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a u Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.

CVE-2026-9251 [MEDIUM] CWE-862 CVE-2026-9251: Missing authorization in the entry status management feature in Devolutions Server allows a non-admi Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Serv

CVE-2026-9522 [MEDIUM] CWE-284 CVE-2026-9522: Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and ear Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.

CVE-2026-5175 [MEDIUM] CWE-862 CVE-2026-5175: Improper access control in the multi-factor authentication (MFA) management API in Devolutions Serve Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.

CVE-2023-2118 [MEDIUM] CVE-2023-2118: Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below all Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.