CVEvulnerability

CVE-2026-5146

4.3 MEDIUM Published 2026-05-12 Modified 2026-10-26 Official page ↗
Status
Analyzed
Published
2026-05-12
Last modified
2026-10-26
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-862

Description

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier

Affected configurations

• devolutions devolutions server (< 2025.3.20.0) • devolutions devolutions server (>= 2026.1.6.0 < 2026.1.16.0)

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References