CVE-2025-11957 | THREATINT

Description

Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.

PUBLISHED Reserved 2025-10-20 | Published 2025-10-22 | Updated 2025-11-25 | Assigner DEVOLUTIONS

CRITICAL: 9.0CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H

Problem types

CWE-639: Authorization Bypass Through User-Controlled Key

Product status

Default status

unaffected

Any version

affected

Credits

Gino Boudreau (mononclemich) finder

References

devolutions.net/security/advisories/DEVO-2025-0015/

cve.org (CVE-2025-11957)

nvd.nist.gov (CVE-2025-11957)

Download JSON