Devolutions Server Improper Access Control Vulnerability in Notification Management Endpoints

A vulnerability exists in Devolutions Server in the notification management endpoints, where improper access control allows an unauthenticated attacker to modify or delete user notification records. This issue arises from inadequate session validation. The vulnerability affects Devolutions Server versions 2026.1.6.0 through 2026.1.15.0, as well as versions 2025.3.19.0 and earlier.

Impact

Exploitation of this vulnerability allows for unauthorized modification or deletion of user notification records.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.16.0 or higher, or to version 2025.3.20.0 or higher.