CVE-2021-23925

Devolutions Server (prior to version 2020.3) contains a cross-site scripting (XSS) vulnerability in Document entries. The issue affects the Document-type data handling and allows injecting JavaScript code, as described across multiple CVE references (CVE-2021-23925) with CVSS v3.1 base score 6.1 ...

CVE-2023-1603

CVE-2023-1603 affects Devolutions Server 2022.3.13 and earlier: a permission bypass vulnerability in the User vault when importing or synchronizing entries, due to an ID collision that lets users with restricted rights bypass entry permissions. The reported impact is that integrity of access cont...

CVE-2021-23924

Summary: Devolutions Server prior to 2020.3 contains an information-disclosure vulnerability where diagnostic files expose sensitive data. Affected product: Devolutions Server (versions before 2020.3). Vulnerability: Exposure of sensitive information in diagnostic files. Root cause stated as info...

CVE-2024-2921

Devolutions Server version 2024.1.10.0 and earlier (also noted as 2024.1.6 and prior in some records) is susceptible to an improper access control vulnerability within the PAM vault permissions . This flaw allows an authenticated user who has access to the PAM to gain unauthorized access to speci...

CVE-2021-23921

CVE-2021-23921 affects Devolutions Server prior to 2020.3. The issue is broken access control on Password List entry elements, as described in the CVE entry and corroborated by NVD/related records. The connected documents confirm the affected software and the underlying flaw (inadequate access re...

CVE-2021-23923

The CVE concerns Devolutions Server prior to 2020.3 with a Broken Authentication issue involving Windows domain users. Public documents identify affected software and the vulnerability type but do not provide exploit details, exact root cause, or remediation steps within the supplied sources. Mon...

CVE-2021-28048

The CVE-2021-28048 entry concerns Devolutions Server (versions prior to 2021.1 and Devolutions Server LTS prior to 2020.3.18). The root cause is an overly permissive Cross-Origin Resource Sharing (CORS) policy that allows a remote attacker to leak cross-origin data via a specially crafted HTML pa...

CVE-2021-28157

CVE-2021-28157 affects Devolutions Server and Devolutions Server LTS. The vulnerability is a SQL injection in the API endpoint api/security/userinfo/delete that allows an administrative user to execute arbitrary SQL commands. Affected versions are Devolutions Server before 2021.1 and Devolutions ...

CVE-2022-3781

CVE-2022-3781 affects Devolutions Remote Desktop Manager (versions 2022.2.26 and earlier) and Devolutions Server (versions 2022.3.1 and earlier). The root cause is that Dashlane passwords and Keepass Server passwords stored in My Account Settings are not encrypted in the database, allowing databa...

CVE-2025-1231

Devolutions Server versions 2024.3.10.0 and earlier are vulnerable to an improper password reset in the PAM Module . A crash in the password reset functionality allows an authenticated user to reuse the oracle user password after check-in. This flaw could lead to unauthorized reuse of passwords a...

CVE-2022-33996

CVE-2022-33996 affects Devolutions Server older than 2022.2. The issue is incorrect permission management where a new user with a preexisting username inherits the permissions of the previous user. Documented impact includes potential confidentiality, integrity, and availability concerns, with CV...

CVE-2025-2280

The Devolutions Server (versions 2024.3.13 and earlier) is vulnerable to an improper access control flaw in the web extension restriction feature. This security weakness allows an authenticated user to bypass the browser extension restriction feature. The impact of this vulnerability is categoriz...

CVE-2024-2915

The Devolutions Server software (version 2024.1.6 and earlier ) is susceptible to an improper access control vulnerability within the PAM JIT elevation feature. An attacker who can access this specific feature may submit a specially crafted request to elevate their privileges to unauthorized grou...

CVE-2025-4316

The Devolutions Server platform contains an improper access control vulnerability in its PAM feature . This flaw allows a PAM user to self-approve their own PAM requests via specific user interface actions, even when the configured policy explicitly disallows such actions. The vulnerability is pr...

CVE-2022-2316

CVE-2022-2316 : The connected sources confirm an HTML injection vulnerability in Devolutions Server prior to 2022.2 affecting the handling of secure messages. The root cause is injection of HTML tags into a secure message (including its header, per CNNVD) that can alter how the page renders or ca...

CVE-2023-1201

CVE-2023-1201 affects Devolutions Server 2022.3.12 and earlier, with an improper access control issue in the secure messages feature. An authenticated attacker who possesses the message UUID can access the data contained in that message, per multiple sources. The CVSSv3.1 base score is 6.5 (Mediu...

CVE-2025-2278

Devolutions Server versions 2024.3.13 and earlier are vulnerable to an improper access control flaw within the temporary access requests and checkout requests endpoints. This vulnerability allows an authenticated user to access sensitive information regarding these requests by utilizing a known r...

CVE-2023-2445

Summary of CVE-2023-2445 (Devolutions Server) Affected software: Devolutions Server, versions 2023.1.1 and earlier. Vulnerability: Improper access control in the Subscriptions Folder path filter. This allows attackers with administrator privileges to retrieve usage information about folders in a ...

CVE-2024-12196

Devolutions Server versions 2024.3.7.0 and earlier are vulnerable to an incorrect authorization flaw within the permission component. This vulnerability allows an authenticated user to view the password history of an entry even if they lack the specific view password permission . The impact is a ...

CVE-2025-2003

Devolutions Server version 2024.3.12 and earlier versions are affected by a vulnerability involving incorrect authorization in PAM vaults . This flaw allows an authenticated user to bypass the 'add in root' permission. While the documents confirm the existence of the vulnerability and the impacte...

CVE-2024-1764

Devolutions Server versions 2023.3.14.0 and earlier are affected by an improper privilege management vulnerability in the Just-in-time (JIT) elevation module . Under specific circumstances, this flaw allows a user to maintain elevated privileges even after they have expired. No exploit informatio...

CVE-2023-5358

CVE-2023-5358 affects Devolutions Server (versions ≤ 2023.2.10.0). The issue is an improper access control in the Report log filters feature, which allows an attacker to retrieve logs from vaults or entries beyond their permissions via the report request URL query parameters. The public documenta...

CVE-2024-10971

Devolutions DVLS versions 2024.3.6 and earlier are affected by an improper access control vulnerability in the Password History feature. A malicious authenticated user can exploit faulty permissions to obtain sensitive data . To remediate this, users should update to a version later than 2024.3.7...

CVE-2025-5382

The Devolutions Server (version 2025.1.7.0 and earlier) is vulnerable to an improper access control flaw within the Multi-Factor Authentication (MFA) feature. This vulnerability allows a user possessing user management permissions to unauthorizedly remove or change the MFA settings of administrat...

CVE-2024-12151

The Devolutions Server (versions 2024.3.8.0 and earlier) is susceptible to an incorrect permission assignment within the user migration feature . This flaw allows users to retain their old permission sets instead of being updated, potentially granting them more access than intended. While the PT-...

CVE-2025-3517

Devolutions Server version 2025.1.5.0 and earlier is susceptible to an incorrect privilege assignment within the PAM JIT elevation feature. The root cause is a failure to update the internal account's SID when a username is updated, which can allow a PAM user to elevate a previously configured us...

CVE-2025-4433

CVE-2025-4433 affects Devolutions Server (versions 2025.1.7.0 and earlier). The vulnerability arises from improper access control in User Group Management, enabling a non-administrative user who has both User Management and User Group Management permissions to escalate privileges by adding users ...

CVE-2024-12148

The Devolutions Server (versions 2024.3.6.0 and earlier) contains an incorrect authorization flaw within its permission validation component. This vulnerability allows an authenticated user to gain unauthorized access to certain reporting endpoints . The impact is characterized as unauthorized ac...

CVE-2024-5072

Devolutions Server versions 2024.1.11.0 and earlier are affected by a vulnerability caused by improper input validation within the PAM JIT elevation feature . An authenticated user with access to this specific feature can perform a specially crafted request to manipulate the LDAP filter query . N...

CVE-2025-2277

Devolutions Server version 2024.3.13 and earlier is affected by a vulnerability in the web-based SSH authentication component . The root cause is a missing password masking mechanism, which allows users to inadvertently leak their SSH passwords. To mitigate this risk, it is recommended to disable...

CVE-2021-36382

CVE-2021-36382 affects Devolutions Server prior to 2021.1.18 and LTS prior to 2020.3.20. The issue allows interception of private keys via a man-in-the-middle attack against the connections/partial endpoint, which accepts plaintext. Affected components and exact root cause are described across mu...

CVE-2023-2118

CVE-2023-2118 affects Devolutions Server 2023.1.5.0 and earlier. The issue is insufficient access control in the support ticket feature, enabling an authenticated attacker to send support tickets and download diagnostic files through specific endpoints. Impact is described as unauthorized access ...

CVE-2026-3224

Devolutions Server versions 2025.3.15.0 and earlier are vulnerable to an authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode. An unauthenticated attacker can authenticate as an arbitrary Entra ID user by providing a forged JSON Web Token (JWT) to the /api/v1/login endpo...

CVE-2023-2400

Summary: CVE-2023-2400 affects Devolutions Server 2023.1.8 and earlier. The vulnerability stems from an improper deletion of resources in the user management feature, which allows an administrator to view the vaults of deleted users via database access. Affected software/area: Devolutions Server,...

CVE-2024-1898

CVE-2024-1898 : Devolutions Server (versions up to 2023.3.14.0) has improper access control in the notification feature, allowing a low-privileged user to change administrator-configured notification settings. The root cause is access control weakness that lets non-admins modify admin-defined con...

CVE-2024-6512

CVE-2024-6512: Affects Devolutions Server 2024.2.10 and earlier. The issue is an authorization bypass in the PAM access request approval mechanism that lets authenticated users with approval permissions approve their own requests, bypassing security restrictions. Impact described as an integrity ...

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. An attacker who gains access to a computer where the software is installed can...

CVE-2026-9247

The Devolutions Server application is vulnerable to insufficient logging within its entry export feature. An authenticated user with export permissions can use a crafted export request to export a sealed entry without triggering the required unseal notification to administrators. This issue affec...

CVE-2025-13765

CVE-2025-13765 affects Devolutions Server, where email service credentials are exposed to non-administrative users. Public details in connected documents specify affected versions as before 2025.2.21 and before 2025.3.9. The issue’s root cause is credential exposure in the email service, with mul...

CVE-2026-10787

Devolutions Server versions 2026.2.4.0 , 2026.1.20.0 , and earlier are vulnerable to a missing authorization flaw in the deleted user groups API. This vulnerability allows an authenticated low-privileged user to enumerate metadata of deleted user groups by sending a crafted API request . While th...

CVE-2026-9251

A missing authorization vulnerability in the entry status management feature of Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow. By sending a crafted status change request, an attacker can gain unauthorized access to an e...

CVE-2024-2918

Improper input validation in the PAM JIT elevation feature of Devolutions Server (version 2024.1.6 and earlier) allows an attacker with access to this feature to forge the displayed group in the PAM JIT elevation checkout request. The flaw is triggered by sending a specially crafted request . Whi...

CVE-2024-4846

An authentication bypass exists in the 2FA feature of Devolutions Server version 2024.1.14.0 and earlier . This vulnerability allows an authenticated attacker to bypass the 2FA requirement to authenticate as another user by utilizing a separate browser tab. No specific remediation details or expl...

CVE-2026-10786

Improper access control in the ticketing integration settings of Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations. This is achieved by sending a crafted API request to the affected system. The vulnerability impact...

CVE-2026-15637

Devolutions Server versions 2026.2.11 and 2026.1.22 are vulnerable to an improper authorization flaw in the PAM SSH key and certificate retrieval endpoints . An authenticated low-privileged user can disclose the private key of an SSH key or certificate PAM credential by using a direct object refe...

CVE-2026-9245

Devolutions Server is vulnerable to an improper input validation flaw within the external authentication provider flow. This vulnerability allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain using a crafted login link. This issue affects Devolutions Serv...

CVE-2026-9246

Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier are susceptible to an improper access control vulnerability. An authenticated user with vault read access can bypass security measures to retrieve documentation and attachments of sealed entries by sending a cr...

CVE-2026-9590

Improper access control in the permission validation component of Devolutions Server (versions 2026.1.19 and earlier ) allows an authenticated user with entry edit privileges to modify asset information without the required permissions. While the vulnerability is confirmed across multiple sources...

CVE-2026-17568

Improper access control in the role membership management endpoint of Devolutions Server allows an authenticated non-administrative user to escalate privileges to administrator . This vulnerability is triggered by sending a crafted API request by a user who already holds the user-group membership...

CVE-2026-8477

An improper enforcement of the sealed-entry workflow in the sensitive-data retrieval feature of Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data. By using a crafted API request, the attacker can bypass the mandatory unseal audit notifica...