BaseFortify

Publication date: 2026-05-12

Last updated on: 2026-05-26

Assigner: Devolutions Inc.

Description

Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-12

Last Modified

2026-05-26

Generated

2026-06-30

EPSS Evaluated

2026-06-28

NVD

CVE-2026-5146

Affected Vendors & Products

Vendor	Product	Version / Range
devolutions	devolutions_server	to 2025.3.20.0 (exc)
devolutions	devolutions_server	From 2026.1.6.0 (inc) to 2026.1.16.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions have not been generated yet.

Hi! I’m here to help you understand CVE-2026-5146. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70