CVE-2026-15058CWE-639

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another…

Low · published July 14, 2026

CVSS v3.1
3.1
EPSS
0%
Percentile
10.6
In the wild
Unconfirmed
What it is

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.

The record
Technical detail
CVSS v3.1
3.1 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00209 · 10.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-14T18:11Z
EPSS history
Timeline
  • 14 JUL 18:11Z
    Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another…
    cvelistv5