CVE-2026-5146CWE-862

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user…

Medium · published May 12, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.

This issue affects the following versions :

*

Devolutions Server 2026.1.6.0 through 2026.1.15.0

*

Devolutions Server 2025.3.19.0 and earlier

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-05-12T17:28Z
EPSS history
Timeline
  • 12 MAY 17:28Z
    Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user…
    cvelistv5