CVE-2026-15058

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier...

CVE-2026-15058

An improper authorization vulnerability exists in the secure messages deletion endpoint of Devolutions Server versions 2026.2.11 and 2026.1.22 . This flaw allows an authenticated user to delete messages belonging to another user by using a direct object reference to the message identifier. Exploi...

CVE-2026-15642

In Devolutions Server versions 2026.1.22.0 and 2026.2.11.0 , the Recovery Kit response file generation feature fails to properly sanitize output. This flaw allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext. This exposure occurs ...

CVE-2026-15642

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...

CVE-2026-15641

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review...

CVE-2026-15641

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review...

CVE-2026-15641

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review...

CVE-2026-15641

Devolutions Server versions 2026.2.11 and 2026.1.22 are vulnerable to an improper authorization flaw in the access request status endpoint . An authenticated low-privileged user can approve their own pending access requests by making a direct call to this endpoint, effectively bypassing the manda...

CVE-2026-15637

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier...

CVE-2026-15637

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier...

CVE-2026-15637

Devolutions Server versions 2026.2.11 and 2026.1.22 are vulnerable to an improper authorization flaw in the PAM SSH key and certificate retrieval endpoints . An authenticated low-privileged user can disclose the private key of an SSH key or certificate PAM credential by using a direct object refe...

PT-2026-58674

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.11 Devolutions Server version 2026.1.22 Description Improper authorization in the secure messages deletion endpoint allows an authenticated user to delete messages belonging to other users. This is achieved...

PT-2026-58677

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...

CVE-2026-15642: Exposure of Sensitive Information to an Unauthorized Actor

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclud...

CVE-2026-15637: Authorization Bypass Through User-Controlled Key

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier...

CVE-2026-15058: Authorization Bypass Through User-Controlled Key

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier...

CVE-2026-15641: Incorrect Authorization

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review...

PT-2026-58676

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.11 Devolutions Server version 2026.1.22 Description Improper authorization in the access request status endpoint allows an authenticated low-privileged user to approve their own pending access request. This is...

Devolutions Server 2026.2.4.0 <= 2026.2.9.0 MFA Bypass (DEVO-2026-0023)

The version of Devolutions Server installed on the remote host is 2026.2.4.0 prior or equal to 2026.2.9.0 and is, therefore, affected by an authentication bypass vulnerability: - Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an...

CVE-2026-14536

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an...