Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
> AFFECTED_PRODUCTS
ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.
CWE-639: Authorization Bypass Through User-Controlled Key - The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
> HISTORIQUE DES MODIFICATIONS
Première apparition
14/07/2026 19:16
Source: NVD
📊
ENRICHISSEMENT
01/08/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-639: Authorization Bypass Through User-Controlled Key - The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key...
Total des modifications: 1
Dernière mise à jour: 3 months ago