CVE-2021-23925

Devolutions Server (prior to version 2020.3) contains a cross-site scripting (XSS) vulnerability in Document entries. The issue affects the Document-type data handling and allows injecting JavaScript code, as described across multiple CVE references (CVE-2021-23925) with CVSS v3.1 base score 6.1 ...

CVE-2023-1603

CVE-2023-1603 affects Devolutions Server 2022.3.13 and earlier: a permission bypass vulnerability in the User vault when importing or synchronizing entries, due to an ID collision that lets users with restricted rights bypass entry permissions. The reported impact is that integrity of access cont...

CVE-2021-23924

Summary: Devolutions Server prior to 2020.3 contains an information-disclosure vulnerability where diagnostic files expose sensitive data. Affected product: Devolutions Server (versions before 2020.3). Vulnerability: Exposure of sensitive information in diagnostic files. Root cause stated as info...

CVE-2024-2921

Devolutions Server versions 2024.1.6 and earlier are affected by an improper access control vulnerability in PAM vault permissions . An authenticated user with access to the PAM can exploit a specific set of permissions to access unauthorized PAM entries . While a patch version is not explicitly ...

CVE-2021-23921

CVE-2021-23921 affects Devolutions Server prior to 2020.3. The issue is broken access control on Password List entry elements, as described in the CVE entry and corroborated by NVD/related records. The connected documents confirm the affected software and the underlying flaw (inadequate access re...

CVE-2021-23923

The CVE concerns Devolutions Server prior to 2020.3 with a Broken Authentication issue involving Windows domain users. Public documents identify affected software and the vulnerability type but do not provide exploit details, exact root cause, or remediation steps within the supplied sources. Mon...

CVE-2023-0952

CVE-2023-0952 affects Devolutions Server 2022.3.12 and earlier, due to improper access controls on entries that could allow an authenticated user to access sensitive data without proper authorization. The CVE has a NVD score of 6.5 (Medium) with network attack vector, low attack complexity, and p...

CVE-2021-28048

The CVE-2021-28048 entry concerns Devolutions Server (versions prior to 2021.1 and Devolutions Server LTS prior to 2020.3.18). The root cause is an overly permissive Cross-Origin Resource Sharing (CORS) policy that allows a remote attacker to leak cross-origin data via a specially crafted HTML pa...

CVE-2021-28157

CVE-2021-28157 affects Devolutions Server and Devolutions Server LTS. The vulnerability is a SQL injection in the API endpoint api/security/userinfo/delete that allows an administrative user to execute arbitrary SQL commands. Affected versions are Devolutions Server before 2021.1 and Devolutions ...

CVE-2022-3781

CVE-2022-3781 affects Devolutions Remote Desktop Manager (versions 2022.2.26 and earlier) and Devolutions Server (versions 2022.3.1 and earlier). The root cause is that Dashlane passwords and Keepass Server passwords stored in My Account Settings are not encrypted in the database, allowing databa...

CVE-2025-1231

Devolutions Server versions 2024.3.10.0 and earlier are vulnerable to an improper password reset in the PAM Module . A crash in the password reset functionality allows an authenticated user to reuse the oracle user password after check-in. This flaw could lead to unauthorized reuse of passwords a...

CVE-2025-2280

The Devolutions Server (versions 2024.3.13 and earlier) is vulnerable to an improper access control flaw in the web extension restriction feature. This security weakness allows an authenticated user to bypass the browser extension restriction feature. The impact of this vulnerability is categoriz...

CVE-2022-33996

CVE-2022-33996 affects Devolutions Server older than 2022.2. The issue is incorrect permission management where a new user with a preexisting username inherits the permissions of the previous user. Documented impact includes potential confidentiality, integrity, and availability concerns, with CV...

CVE-2023-0661

CVE-2023-0661 affects Devolutions Server. The vulnerability is an improper access control flaw that allows an authenticated user to access sensitive data they should not be able to view. The root cause is an access-control weakness; the impact is stated as high confidentiality impact with no inte...

CVE-2024-2915

The Devolutions Server software (version 2024.1.6 and earlier ) is susceptible to an improper access control vulnerability within the PAM JIT elevation feature. An attacker who can access this specific feature may submit a specially crafted request to elevate their privileges to unauthorized grou...

CVE-2023-1201

CVE-2023-1201 affects Devolutions Server 2022.3.12 and earlier, with an improper access control issue in the secure messages feature. An authenticated attacker who possesses the message UUID can access the data contained in that message, per multiple sources. The CVSSv3.1 base score is 6.5 (Mediu...

CVE-2025-4316

The Devolutions Server platform contains an improper access control vulnerability in its PAM feature . This flaw allows a PAM user to self-approve their own PAM requests via specific user interface actions, even when the configured policy explicitly disallows such actions. The vulnerability is pr...

CVE-2024-1901

A Denial of Service (DoS) vulnerability exists in Devolutions Server version 2023.3.14.0 (and prior versions) during the PAM password rotation process. This flaw occurs during the check-in process , where an authenticated user possessing specific PAM permissions can cause PAM credentials to becom...

CVE-2022-2316

CVE-2022-2316 : The connected sources confirm an HTML injection vulnerability in Devolutions Server prior to 2022.2 affecting the handling of secure messages. The root cause is injection of HTML tags into a secure message (including its header, per CNNVD) that can alter how the page renders or ca...

CVE-2023-2445

Summary of CVE-2023-2445 (Devolutions Server) Affected software: Devolutions Server, versions 2023.1.1 and earlier. Vulnerability: Improper access control in the Subscriptions Folder path filter. This allows attackers with administrator privileges to retrieve usage information about folders in a ...

CVE-2024-12196

Devolutions Server versions 2024.3.7.0 and earlier are vulnerable to an incorrect authorization flaw within the permission component. This vulnerability allows an authenticated user to view the password history of an entry even if they lack the specific view password permission . The impact is a ...

CVE-2025-2003

Devolutions Server versions 2024.3.12 and earlier are affected by a vulnerability involving incorrect authorization within PAM vaults . This flaw allows an authenticated user to bypass the 'add in root' permission , potentially enabling the execution of restricted actions. While the documents rec...

CVE-2025-2278

Devolutions Server versions 2024.3.13 and earlier are vulnerable to an improper access control flaw within the temporary access requests and checkout requests endpoints. This vulnerability allows an authenticated user to access sensitive information regarding these requests by utilizing a known r...

CVE-2024-1764

Devolutions Server versions 2023.3.14.0 and earlier are affected by an improper privilege management vulnerability in the Just-in-time (JIT) elevation module . Under specific circumstances, this flaw allows a user to maintain elevated privileges even after they have expired. No exploit informatio...

CVE-2023-0951

CVE-2023-0951 affects Devolutions Server 2022.3.12 and earlier, due to improper access controls on certain API endpoints. A standard privileged user could perform privileged actions, with impact described as high for confidentiality, integrity, and availability. The provided documents identify th...

CVE-2023-5358

CVE-2023-5358 affects Devolutions Server (versions ≤ 2023.2.10.0). The issue is an improper access control in the Report log filters feature, which allows an attacker to retrieve logs from vaults or entries beyond their permissions via the report request URL query parameters. The public documenta...

CVE-2025-0691

An improper access control vulnerability exists in the permissions component of Devolutions Server version 2025.1.10.0 and earlier . This flaw allows an authenticated user to bypass the "Edit permission" permission by circumventing client-side validation . The primary impact is unauthorized modif...

CVE-2025-4433

CVE-2025-4433 affects Devolutions Server (versions 2025.1.7.0 and earlier). The vulnerability arises from improper access control in User Group Management, enabling a non-administrative user who has both User Management and User Group Management permissions to escalate privileges by adding users ...

CVE-2024-10971

Devolutions DVLS versions 2024.3.6 and earlier are affected by an improper access control vulnerability in the Password History feature. A malicious authenticated user can exploit faulty permissions to obtain sensitive data . To remediate this, users should update to a version later than 2024.3.7...

CVE-2024-12151

The Devolutions Server (versions 2024.3.8.0 and earlier) is susceptible to an incorrect permission assignment within the user migration feature . This flaw allows users to retain their old permission sets instead of being updated, potentially granting them more access than intended. While the PT-...

CVE-2025-3517

The Devolutions Server (version 2025.1.5.0 and earlier) is affected by an incorrect privilege assignment within the PAM JIT elevation feature. The root cause is a failure to update the internal account's SID when a username is updated, which allows a PAM user to elevate a previously configured us...

CVE-2025-5382

The Devolutions Server (version 2025.1.7.0 and earlier) is vulnerable to an improper access control flaw within the Multi-Factor Authentication (MFA) feature. This vulnerability allows a user possessing user management permissions to unauthorizedly remove or change the MFA settings of administrat...

CVE-2023-5575

Devolutions Server CVE-2023-5575 affects versions 2022.3.13.0 and earlier. The issue is improper access control in permission inheritance, enabling a low-privileged, compromised user to access entries via a specific combination of permissions on the entry and its parent. Remediation is to update ...

CVE-2024-12148

The Devolutions Server (versions 2024.3.6.0 and earlier) contains an incorrect authorization flaw within its permission validation component. This vulnerability allows an authenticated user to gain unauthorized access to certain reporting endpoints . The impact is characterized as unauthorized ac...

CVE-2021-36382

CVE-2021-36382 affects Devolutions Server prior to 2021.1.18 and LTS prior to 2020.3.20. The issue allows interception of private keys via a man-in-the-middle attack against the connections/partial endpoint, which accepts plaintext. Affected components and exact root cause are described across mu...

CVE-2023-2118

CVE-2023-2118 affects Devolutions Server 2023.1.5.0 and earlier. The issue is insufficient access control in the support ticket feature, enabling an authenticated attacker to send support tickets and download diagnostic files through specific endpoints. Impact is described as unauthorized access ...

CVE-2024-5072

Devolutions Server versions 2024.1.11.0 and earlier are affected by a security vulnerability involving improper input validation within the PAM JIT elevation feature. An authenticated user with access to this feature can manipulate LDAP filter queries by sending a specially crafted request. While...

CVE-2025-2277

Devolutions Server version 2024.3.13 and earlier is affected by a vulnerability in the web-based SSH authentication component . The root cause is a missing password masking mechanism, which allows users to inadvertently leak their SSH passwords. To mitigate this risk, it is recommended to disable...

CVE-2025-4493

Devolutions Server is vulnerable to an improper privilege assignment within PAM JIT privilege sets. By exploiting a user interface issue, a PAM user can perform PAM JIT requests on unauthorized groups. This issue affects Devolutions Server versions 2024.3.15.0 and earlier and 2025.1.3.0 through 2...

CVE-2023-0953

The CVE concerns Devolutions Server (version 2022.3.12 and earlier). The root cause is insufficient input sanitization in the documentation feature, enabling an authenticated attacker to perform an SQL Injection and potentially access system resources. Impact is described as high (C/H/I/A), with ...

CVE-2025-3768

The Devolutions Server (version 2025.1.10.0 and earlier) is susceptible to an improper access control vulnerability within its Tor network blocking feature . This flaw allows an authenticated user to bypass the Tor blocking mechanism specifically when the Devolutions hosted endpoint is unreachabl...

CVE-2023-2400

Summary: CVE-2023-2400 affects Devolutions Server 2023.1.8 and earlier. The vulnerability stems from an improper deletion of resources in the user management feature, which allows an administrator to view the vaults of deleted users via database access. Affected software/area: Devolutions Server,...

CVE-2023-5240

CVE-2023-5240 concerns Devolutions Server (versions 2023.2.8.0 and earlier) with improper access control in PAM propagation scripts. The root cause, per Red Hat and other sources, is that an attacker with permission to manage PAM propagation scripts can retrieve passwords stored in those scripts ...

CVE-2024-1898

CVE-2024-1898 : Devolutions Server (versions up to 2023.3.14.0) has improper access control in the notification feature, allowing a low-privileged user to change administrator-configured notification settings. The root cause is access control weakness that lets non-admins modify admin-defined con...

CVE-2024-6512

CVE-2024-6512: Affects Devolutions Server 2024.2.10 and earlier. The issue is an authorization bypass in the PAM access request approval mechanism that lets authenticated users with approval permissions approve their own requests, bypassing security restrictions. Impact described as an integrity ...

CVE-2026-3224

Devolutions Server versions 2025.3.15.0 and earlier are vulnerable to an authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode. An unauthenticated attacker can authenticate as an arbitrary Entra ID user by providing a forged JSON Web Token (JWT) to the /api/v1/login endpo...

CVE-2024-1900

The Devolutions Server (version 2023.3.14.0 and earlier) contains a vulnerability due to improper session management within the identity provider authentication flow. This flaw allows an authenticated user, who logged in via an identity provider like Okta or Microsoft O365 , to remain authenticat...

CVE-2025-13765

CVE-2025-13765 affects Devolutions Server, where email service credentials are exposed to non-administrative users. Public details in connected documents specify affected versions as before 2025.2.21 and before 2025.3.9. The issue’s root cause is credential exposure in the email service, with mul...

CVE-2026-9247

The Devolutions Server application is vulnerable to insufficient logging within its entry export feature. An authenticated user with export permissions can use a crafted export request to export a sealed entry without triggering the required unseal notification to administrators. This issue affec...

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. This flaw allows an attacker with physical or local access to a computer where...