Improper Access Control in Devolutions Server 2025 Series
CVE-2025-12808

6.5MEDIUM

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
6 November 2025

What is CVE-2025-12808?

An improper access control issue in Devolutions Server up to version 2025.3.5.0 enables a View-only user to access sensitive third-level nested fields, including custom values in password lists. This flaw may lead to unauthorized password disclosure, posing potential security risks for affected systems and users.

Affected Version(s)

Server 2025.3.2.0 <= 2025.3.5.0

Server 0 <= 2025.2.15.0

References

https://devolutions.net/security/advisories/DEVO-2025-0016

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.