Auth bypass in Devolutions Server
CVE-2026-5146
Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.003 (17.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 17.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001
Affected products
- Devolutions Server
- Devolutions Server — versions 2026.1.6.0, 0
Weakness classification (CWE)
References
- devolutions.net/security/advisories/DEVO-2026-0012 (Vendor Advisory)
Frequently asked questions
- What is CVE-2026-5146?
- CVE-2026-5146 is a medium-severity vulnerability in Devolutions Server, classified under Missing Authorization. CVSS score: 4.3/10. Published 2026-05-12.
- How severe is CVE-2026-5146?
- Medium severity. CVSS v3 base score is 4.3 out of 10.