HTML injection in the secure message title

Some HTML tags could be injected in the title of secure messages. Javascript code execution via this injection is not possible due to sanitizing done by the Angular framework. An attacker with access to Devolutions Server could use it to alter the rendering of the page or redirect a user to another site.

Incorrect handling of permissions when creating a user with a pre-existing username

When deleting a user, the permission assignments remained in the database. If a new user was created with the same username, the user would get the permissions of that previous user.

Starting with Devolutions Server 2022.2, permissions are assigned based on the user unique ID instead of its username.