Access Control

Every one of the 80 is a mark on the map. Named now: 1 to 26, most at risk first.

1. An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerShell.CVE-2021-42098Devolutions · 1.9% likely

   CWE-276

2. Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous user.CVE-2022-33996Devolutions · 1.1% likely

   CWE-276

3. Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to retrieve usage information…CVE-2023-2445Devolutions · CVSS 4.9 · 1.0% likely

   CWE-346

4. Improper access control in PAM dashboard in Devolutions Remote Desktop Manager 2024.2.11 and earlier on Windows allows an authenticated user to bypass the execute permission via t…CVE-2024-6354Devolutions · CVSS 7.2 · 0.8% likely

   CWE-1262

5. Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passw…CVE-2023-5240Devolutions · 0.7% likely

   CWE-284

6. Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.CVE-2023-0661Devolutions · CVSS 6.5 · 0.7% likely

   CWE-284

7. Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL…CVE-2023-6593Devolutions · 0.7% likely

   CWE-732

8. Incorrect authorization in the permission validation component of Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows a malicious authenticated user to bypa…CVE-2024-11670Devolutions · CVSS 5.4 · 0.7% likely

   CWE-863

9. Improper access controls on entries in Devolutions Server 2022.3.12 and earlier could allow an authenticated user to access sensitive data without proper authorization.CVE-2023-0952Devolutions · CVSS 6.5 · 0.7% likely

   CWE-863

10. Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. T…CVE-2022-3780Devolutions · CVSS 7.5 · 0.7% likely

    CWE-284

11. Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to un…CVE-2024-2915Devolutions · CVSS 8.8 · 0.6% likely

    CWE-863

12. Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry perm…CVE-2023-1603Devolutions · CVSS 6.5 · 0.6% likely

    CWE-863

13. Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0 and earlier on Windows allows an authenticated user that r…CVE-2024-12149Devolutions · CVSS 8.1 · 0.6% likely

    CWE-732

14. Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a privileged account.CVE-2022-3641Devolutions · CVSS 8.8 · 0.6% likely

    CWE-269

15. Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-M…CVE-2025-12485Devolutions · CVSS 8.8 · 0.6% likely

    CWE-269

16. An overly permissive CORS policy in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows a remote attacker to leak cross-origin data via a crafted H…CVE-2021-28048Devolutions · 0.6% likely

    CWE-346

17. Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Manageme…CVE-2025-4433Devolutions · CVSS 8.8 · 0.6% likely

    CWE-284

18. Incorrect authorization in the add permission component in Devolutions Remote Desktop Manager 2024.2.21 and earlier on Windows allows an authenticated malicious user to bypass the…CVE-2024-11672Devolutions · CVSS 4.3 · 0.5% likely

    CWE-863

19. Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction…CVE-2025-2280Devolutions · CVSS 8.1 · 0.5% likely

    CWE-284

20. Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the…CVE-2024-12196Devolutions · CVSS 6.5 · 0.5% likely

    CWE-863

21. Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information…CVE-2025-2278Devolutions · CVSS 6.5 · 0.5% likely

    CWE-284

22. Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.CVE-2025-2003Devolutions · CVSS 7.1 · 0.4% likely

    CWE-863

23. Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions allows users with restricted rights to by…CVE-2023-1202Devolutions · CVSS 6.5 · 0.4% likely

    CWE-863

24. Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment featur…CVE-2025-6741Devolutions · CVSS 7.7 · 0.4% likely

    CWE-284

25. Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclos…CVE-2025-12808Devolutions · CVSS 6.5 · 0.4% likely

    CWE-284

26. Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required p…CVE-2026-14536Devolutions · CVSS 7.3 · 0.4% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.