Skip to content
CVE PROGRAM SOURCE RECORD4.3 Medium

CVE-2026-5146

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records vi

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
DEVOLUTIONS

Description

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Devolutions Server

Default version status: unaffected

  • 2026.1.6.0 to ≤ 2026.1.15.0affected
  • 0 to ≤ 2025.3.19.0affected

References