CVE-2026-5146

Devolutions Server is vulnerable to an improper access control flaw in its notification management endpoints due to missing session validation . This allows an unauthenticated attacker to modify or delete arbitrary user notification records. The issue affects Devolutions Server versions 2026.1.6....