Improper Authorization in Devolutions Server Access Request Status

Executive Summary

This vulnerability is an improper authorization issue in Devolutions Server versions 2026.2.11 and 2026.1.22. It affects the access request status endpoint.

An authenticated low-privileged user can exploit this flaw by directly calling the request status endpoint. This allows them to approve their own pending access request without requiring review or approval from an authorized approver.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking for unusual access request approval patterns in Devolutions Server logs or monitoring direct calls to the access request status endpoint by low-privileged users.

• Review server logs for instances where a user approves their own access request, especially if the user has low privileges.
• Use network monitoring tools to inspect HTTP requests to the access request status endpoint, filtering for requests where the approver and requester are the same user.
• Check for unexpected changes in access request statuses by querying the Devolutions Server database or API for approvals that bypassed the standard review process.

Specific commands or tools depend on your environment and access to Devolutions Server internals. If you have access to the server logs, you could use grep or similar tools to search for patterns like:

• grep -i 'approve.*own.*request' /path/to/devolutions/server/logs
• Monitor API calls to the endpoint (e.g., /api/access/request/status) using tools like Wireshark or Burp Suite to identify direct calls by low-privileged users.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of Devolutions Server, this vulnerability could allow low-privileged users to bypass security controls and gain unauthorized access to resources or systems.

This could lead to unauthorized data access, privilege escalation, or misuse of sensitive systems, potentially resulting in data breaches or operational disruptions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may impact compliance with several standards and regulations, depending on the data or systems involved.

• GDPR: Unauthorized access to personal data due to improper authorization could violate GDPR requirements for data protection and access control, leading to potential fines or legal consequences.
• HIPAA: If the affected system handles protected health information (PHI), this vulnerability could result in unauthorized access to PHI, violating HIPAA's access control and audit requirements.
• Other standards like ISO 27001 or NIST frameworks may also be impacted, as they require proper authorization and access control mechanisms to be in place.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these steps:

• Apply the latest security patches or updates provided by Devolutions for Server 2026.2.11 or 2026.1.22, as they may include fixes for this improper authorization issue.
• Restrict access to the access request status endpoint to only users with approver privileges. This can be done by modifying the server's access control policies or firewall rules.
• Implement additional server-side validation to ensure that a user cannot approve their own access request, even if they bypass the frontend checks.
• Monitor and audit access request approvals regularly to detect any unauthorized or suspicious activity.
• Temporarily disable the access request feature if patches are not immediately available and the risk is deemed unacceptable.
• Notify all users, especially approvers, about the vulnerability and advise them to manually verify any access request approvals until a fix is applied.

Useful 0 Not Useful 0