Devolutions Server Multiple Authorization Bypass Vulnerabilities (IDOR/CVEs) and Patch Details

Vulnerability Overview Vulnerability ID: DEVO-2026-0024 Vulnerability Description: Devolutions Server has multiple vulnerabilities, including: 1. Improper Authorization on the PAM SSH Key and Certificate Retrieval Endpoint 2. Improper Authorization on the Access Request Status Endpoint Allowing Self-Approval 3. Azure Key Vault Client Key Inserted into the Recovery Package Response File 4. Improper Authorization (IDOR) on the Secure Message Deletion Endpoint Scope of Impact Affected Products: Devolutions Server 2026.2.11 and earlier, 2026.1.22 and earlier Vulnerability Details: 1. Improper Authorization on the PAM SSH Key and Certificate Retrieval Endpoint - CVE ID: CVE-2026-15637 - CVSS Score: 7.3 High - Description: Allows authenticated low-privilege users to disclose SSH keys or certificate PAM credentials via Direct Object Reference (IDOR). 2. Improper Authorization on the Access Request Status Endpoint Allowing Self-Approval - CVE ID: CVE-2026-15641 - CVSS Score: 7.1 High - Description: Allows authenticated low-privilege users to approve their own pending access requests, bypassing the required approval workflow. 3. Azure Key Vault Client Key Inserted into the Recovery Package Response File - CVE ID: CVE-2026-15642 - CVSS Score: 2.0 Low - Description: Allows attackers to obtain the Azure Key Vault client key via the generated response file, even when the option to exclude sensitive data is selected. 4. Improper Authorization (IDOR) on the Secure Message Deletion Endpoint - CVE ID: CVE-2026-15658 - CVSS Score: 3.1 Low - Description: Allows authenticated users to delete other users' messages via Direct Object Reference (IDOR). Remediation Remediation Measure: Upgrade to Devolutions Server 2026.1.23.0, 2026.2.12.0, or later versions. POC Code or Exploit Code No POC code or exploit code is included in this document.

Goal Reached Thanks to every supporter — we hit 100%!

Devolutions Server Multiple Authorization Bypass Vulnerabilities (IDOR/CVEs) and Patch Details