Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2026-0007
Devolutions Server is affected by an improper access control vulnerability.
Affected Products
Devolutions Server
2025.3.11.0 and earlier
Change Log
Initial publication - 2026-03-09
6.0 Medium - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
Improper access control in user and role restore API endpoints
Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.
Affected Products
CVE(s)
CVE-2026-3638
Remediation and Workarounds
Upgrade to Devolutions Server 2025.3.12.0 or higher.