CVE-2026-5146
Improper access control in the notification management endpoints in Devolutions Server allows an...
CVE-2026-5146 is a medium vulnerability (CVSS 4.3) in Devolutions Server, published May 12, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.16%, the 5th percentile. No source names a fixed version.
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.15.0
Devolutions Server 2025.3.19.0 and earlier
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.15.0
Devolutions Server 2025.3.19.0 and earlier
- Record
CVE-2026-5146- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
EUVDEUVD-2026-29733
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.15.0
Devolutions Server 2025.3.19.0 and earlier
- Record
EUVD-2026-29733- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hm73-pxhm-5967
Improper access control in the notification management endpoints in Devolutions Server allows an...
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.15.0
Devolutions Server 2025.3.19.0 and earlier
- Record
GHSA-hm73-pxhm-5967- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
NVD
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.15.0
Devolutions Server 2025.3.19.0 and earlier
- Record
CVE-2026-5146- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD |