Improper Access Control in Devolutions Server 2025 Series
CVE-2025-12808

Currently unrated

Key Information:

Vendor: Devolutions
Status: Server
Vendor: CVE Published:; 6 November 2025

🔔 Create Devolutions Vulnerability Alert

What is CVE-2025-12808?

An improper access control issue in Devolutions Server up to version 2025.3.5.0 enables a View-only user to access sensitive third-level nested fields, including custom values in password lists. This flaw may lead to unauthorized password disclosure, posing potential security risks for affected systems and users.

Affected Version(s)

Server 0 <= 2025.3.5.0

References

https://devolutions.net/security/advisories/DEVO-2025-0016

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Nov 6, 2025
Vulnerability Reserved
Nov 6, 2025

JSON