CVE-2025-0691 - Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation

Back Back to CVE browser

MEDIUM

Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation

Published Jun 5, 2025

5.0

MEDIUM

CVSS 3.1

EPSS 0.32%

Description

Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.

Affected products

Vendor Devolutions Product Server Default
unaffected
Affected
- ≥ 0, ≤ 2025.1.10.0

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Devolutions	Server	unaffected	Affected ≥ 0, ≤ 2025.1.10.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-284

References (2)

https://devolutions.net/security/advisories/DEVO-2025-0011/
Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16997
Advisory

Link	Providers	Tags
https://devolutions.net/security/advisories/DEVO-2025-0011/		Vendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-16997		Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner DEVOLUTIONS

Published Jun 5, 2025

Updated Jun 5, 2025

Reserved Jan 23, 2025

Link CVE-2025-0691

CISA Vulnrichment

Updated Jun 5, 2025

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2025-0691

Red Hat

No data

ENISA EUVD

Assigner DEVOLUTIONS

Published Jun 5, 2025

Updated Jun 5, 2025

Link EUVD-2025-16997

GitHub

No data