Server
by Devolutions
CVEs (114)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-1900 | Med | 0.36 | 5.5 | 0.00 | Mar 5, 2024 | Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or… | ||
| CVE-2026-9522 | Med | 0.35 | 5.4 | 0.00 | Jun 2, 2026 | Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations. | ||
| CVE-2026-9251 | Med | 0.35 | 5.4 | 0.00 | May 22, 2026 | Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects… | ||
| CVE-2026-4829 | Med | 0.35 | 5.4 | 0.00 | Apr 1, 2026 | Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow. | ||
| CVE-2025-1231 | Med | 0.35 | 5.4 | 0.00 | Feb 11, 2025 | Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality. | ||
| CVE-2023-2118 | Med | 0.35 | 5.4 | 0.00 | Apr 21, 2023 | Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints. | ||
| CVE-2022-2316 | Med | 0.35 | 5.4 | 0.01 | Jul 6, 2022 | HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site. | ||
| CVE-2026-9590 | Med | 0.34 | 5.3 | 0.00 | Jun 2, 2026 | Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission. | ||
| CVE-2023-6264 | Med | 0.34 | 5.3 | 0.01 | Nov 22, 2023 | Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints. | ||
| CVE-2023-5358 | Med | 0.34 | 5.3 | 0.01 | Nov 1, 2023 | Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters. | ||
| CVE-2026-9245 | Med | 0.33 | 5.0 | 0.00 | May 22, 2026 | Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through… | ||
| CVE-2026-5175 | Med | 0.33 | 5.0 | 0.00 | Apr 1, 2026 | Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. … | ||
| CVE-2026-4925 | Med | 0.33 | 5.0 | 0.00 | Apr 1, 2026 | Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from… | ||
| CVE-2025-3768 | Med | 0.33 | 5.0 | 0.00 | Jun 5, 2025 | Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable. | ||
| CVE-2025-0691 | Med | 0.33 | 5.0 | 0.00 | Jun 5, 2025 | Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation. | ||
| CVE-2024-12151 | Med | 0.33 | 5.0 | 0.00 | Dec 4, 2024 | Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets. | ||
| CVE-2026-3221 | Med | 0.32 | 4.9 | 0.00 | Feb 25, 2026 | Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access. | ||
| CVE-2023-2445 | Med | 0.32 | 4.9 | 0.01 | May 2, 2023 | Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name. | ||
| CVE-2026-12117 | Med | 0.28 | 4.3 | 0.00 | Jun 16, 2026 | Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request. | ||
| CVE-2026-11890 | Med | 0.28 | 4.3 | 0.00 | Jun 16, 2026 | Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results. |
- risk 0.36cvss 5.5epss 0.00
Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or…
- risk 0.35cvss 5.4epss 0.00
Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
- risk 0.35cvss 5.4epss 0.00
Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects…
- risk 0.35cvss 5.4epss 0.00
Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.
- risk 0.35cvss 5.4epss 0.00
Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after check-in due to crash in the password reset functionality.
- risk 0.35cvss 5.4epss 0.00
Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and download diagnostic files via specific endpoints.
- risk 0.35cvss 5.4epss 0.01
HTML injection vulnerability in secure messages of Devolutions Server before 2022.2 allows attackers to alter the rendering of the page or redirect a user to another site.
- risk 0.34cvss 5.3epss 0.00
Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.
- risk 0.34cvss 5.3epss 0.01
Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints.
- risk 0.34cvss 5.3epss 0.01
Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries they are not allowed to access via the report request url query parameters.
- risk 0.33cvss 5.0epss 0.00
Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through…
- risk 0.33cvss 5.0epss 0.00
Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. …
- risk 0.33cvss 5.0epss 0.00
Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from…
- risk 0.33cvss 5.0epss 0.00
Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable.
- risk 0.33cvss 5.0epss 0.00
Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
- risk 0.33cvss 5.0epss 0.00
Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
- risk 0.32cvss 4.9epss 0.00
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
- risk 0.32cvss 4.9epss 0.01
Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information on folders in user vaults via a specific folder name.
- risk 0.28cvss 4.3epss 0.00
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.
- risk 0.28cvss 4.3epss 0.00
Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.
Page 4 of 6