[CVE-2026-15641] Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1…

Descripción técnica

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.

Puntuación CVSS

Score: 7.1/10 — Severidad: HIGH — Estado NIST: Analyzed

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Productos afectados

Devolutions server — Devolutions

Debilidades (CWE)

CWE-863

Fuente oficial

Publicado en NIST NVD.