Insecure Direct Object Reference

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary a…CVE-2025-11957Devolutions · CVSS 8.4 · 0.3% likely

   CWE-639

2. Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafte…CVE-2026-17570Devolutions · CVSS 4.3 · 0.3% likely

   CWE-639

3. Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose th…CVE-2026-15637Devolutions · CVSS 7.5 · 0.3% likely

   CWE-639

4. Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a dir…CVE-2026-15058Devolutions · CVSS 3.1 · 0.2% likely

   CWE-639

5. Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from…CVE-2026-9248Devolutions · CVSS 2.6 · 0.2% likely

   CWE-639

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.