Improper Authorization in Devolutions Server Affects User Access

CVE-2025-11957

What is CVE-2025-11957?

The vulnerability in Devolutions Server allows authenticated basic users to bypass intended access controls within the temporary access workflow. This weakness enables users to either self-approve or approve other users' temporary access requests, potentially granting them unauthorized access to sensitive vaults and entries through specially crafted API requests. The affected versions include Devolutions Server 2025.2.12.0 and earlier, raising concerns for organizations using this platform to manage access permissions. Immediate attention to patch and mitigate this vulnerability is crucial to maintain secure access management.

References