CVE-2026-5146: Medium severity Devolutions Devolutions Server vulnerability
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation.
This issue affects the following versions :
Devolutions Server 2026.1.6.0 through 2026.1.15.0
Devolutions Server 2025.3.19.0 and earlier
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5146?
CVE-2026-5146 is considered a critical severity vulnerability due to improper access control allowing unauthenticated access.
How do I fix CVE-2026-5146?
To fix CVE-2026-5146, ensure you update to Devolutions Server version 2026.1.15.0 or later.
Which versions of Devolutions Server are affected by CVE-2026-5146?
CVE-2026-5146 affects Devolutions Server versions 2026.1.6.0 through 2026.1.15.0 and all versions up to 2025.3.19.0.
What type of vulnerability is CVE-2026-5146?
CVE-2026-5146 represents an access control vulnerability that allows modification or deletion of user notification records.
Can an attacker exploit CVE-2026-5146 remotely?
Yes, an unauthenticated attacker can remotely exploit CVE-2026-5146 due to missing session validation.