Improper Authorization in Devolutions Server Affects User Access
CVE-2025-11957

9CRITICAL

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
22 October 2025

What is CVE-2025-11957?

The vulnerability in Devolutions Server allows authenticated basic users to bypass intended access controls within the temporary access workflow. This weakness enables users to either self-approve or approve other users' temporary access requests, potentially granting them unauthorized access to sensitive vaults and entries through specially crafted API requests. The affected versions include Devolutions Server 2025.2.12.0 and earlier, raising concerns for organizations using this platform to manage access permissions. Immediate attention to patch and mitigate this vulnerability is crucial to maintain secure access management.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Server 0 <= 2025.2.12.0

References

https://devolutions.net/security/advisories/DEVO-2025-0015/

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.