Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2026-0004
Devolutions Server is affected by multiple vulnerabilities.
Affected Products
Change Log
Initial publication - 2026-02-24
7.6 High - CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Authorization bypass via permission cache poisoning
A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.
Affected Products
CVE(s)
CVE-2026-1768
Remediation and Workarounds
Upgrade to DVLS 2025.3.15
Credits
JaGoTu, DCIT a.s.
8.5 High - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
Sensitive credential exposure via /api/connections endpoints for view-only users
Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data through requests to the /api/connections/{id} endpoints.
Affected Products
CVE(s)
CVE-2026-3131
Remediation and Workarounds
Upgrade to DVLS 2025.3.15