High · published October 22, 2025
🚨 An authorized user can approve their own access requests! In Devolutions Server 2025.2.12.0 and earlier, a crafty authenticated user can exploit a loophole in the temporary access system. 🔥 Think of it like an employee who, instead of waiting for management approval, sneaks into the system and gives themselves VIP access to all the restricted files. They're running the show without anyone knowing! This vulnerability allows an attacker to gain unauthorized access to sensitive vaults and entries, potentially exposing critical information and risking data integrity. It's like handing out the keys to the kingdom and letting anyone stroll in, do as they please, and leave with everything!
Think of it like an employee who, instead of waiting for management approval, sneaks into the system and gives themselves VIP access to all the restricted files. They're running the show without anyone knowing! The flaw arises from improper authorization in the temporary access workflow, allowing an authenticated basic user to self-approve or approve others' access requests through crafted API calls.
This vulnerability allows an attacker to gain unauthorized access to sensitive vaults and entries, potentially exposing critical information and risking data integrity. It's like handing out the keys to the kingdom and letting anyone stroll in, do as they please, and leave with everything! Immediately patch to version 2025.2.12.1 or later to fix this critical flaw. Review your user roles and permissions to ensure that only authorized personnel can approve access requests. You've got this! With these steps, you'll secure your vaults in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| devolutions/devolutions_server | < 2025.2.14.0 | 2025.2.14.0 |