CVE-2026-3638

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0...

5.9 Medium

CVE-2026-3638 is a medium vulnerability (CVSS 5.9) in Devolutions Server, published March 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. No source names a fixed version.

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: High
Availability: None

Exploit likelihood

0.18%Up 0.2 points since Mar 10, 2026

What each source reports

CVE List Score used 5.9

Record: CVE-2026-3638
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

EUVDEUVD-2026-10348 5.9

Record: EUVD-2026-10348
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-hgq7-qm2h-756x 5.9

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0...

Record: GHSA-hgq7-qm2h-756x
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

NVD 5.9

Record: CVE-2026-3638
CVSS 3.1: 5.9 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N
Weakness: CWE-862
Updated: 2026-11-02

Affected products

devolutions server

History

History
When	Changed	Sources
2026-11-02	created	CVE List, EUVD, GitHub Advisories, NVD