Improper Authorization in Devolutions Server Message Deletion

Executive Summary

This vulnerability is an improper authorization issue in Devolutions Server versions 2026.2.11 and earlier, as well as 2026.1.22 and earlier. It involves an Insecure Direct Object Reference (IDOR) in the secure messages deletion endpoint, allowing an authenticated user to delete another user's messages by directly referencing the message identifier.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves improper authorization in the secure messages deletion endpoint of Devolutions Server. Detection requires checking for unauthorized message deletions in server logs or monitoring user actions targeting message identifiers. No specific commands are provided in the context, but reviewing server logs for unusual deletion patterns or unauthorized access attempts may help identify exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An authenticated attacker could exploit this flaw to delete messages belonging to other users, potentially leading to data loss or unauthorized information removal. While the impact is limited due to the low CVSS score, it may still cause inconvenience or disrupt communication within the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with data protection regulations like GDPR or HIPAA by enabling unauthorized deletion of user data. However, the low CVSS score suggests limited risk. Organizations should still address it to maintain data integrity and compliance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Devolutions Server to version 2026.2.12 or 2026.1.23 or higher to remediate the improper authorization flaw in the secure messages deletion endpoint.

Useful 0 Not Useful 0