CVE-2025-11957: Critical severity Devolutions Server vulnerability
Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11957?
CVE-2025-11957 is considered a high severity vulnerability due to the potential for unauthorized access to sensitive information.
How do I fix CVE-2025-11957?
To remediate CVE-2025-11957, update Devolutions Server to version 2025.2.12.1 or later.
What type of systems are affected by CVE-2025-11957?
CVE-2025-11957 affects Devolutions Server versions up to 2025.2.12.0.
What are the risks associated with CVE-2025-11957?
The risk associated with CVE-2025-11957 includes unauthorized access to vaults and entries by exploiting improper authorization.
Who can exploit CVE-2025-11957?
An authenticated basic user can exploit CVE-2025-11957 by self-approving or approving temporary access requests of other users.