Devolutions Server Improper Access Control in MFA Management API Allowing Account Protection Reduction

A vulnerability exists in the multi-factor authentication (MFA) management API of Devolutions Server, specifically in versions 2026.1.6 through 2026.1.11. This vulnerability allows an authenticated attacker to delete their own MFA factors, reverting their account security to password-only authentication, by sending crafted HTTP requests. The issue arises from improper access control, which enables users to bypass restrictions and manipulate their MFA settings.

Impact

Exploitation of this vulnerability allows for the removal of multi-factor authentication, leaving accounts protected only by passwords.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.12 or higher.