CVE-2025-11957

The temporary access workflow mechanism does not properly verify whether the user submitting the approval request has the appropriate permissions to accept it (CWE-639: Insecure Direct Object Reference / Improper Authorization). An attacker with a regular user account can send crafted API requests that bypass authorization controls and allow approval of their own or another user's temporary access request. No interaction from an administrator is required, nor is elevated privilege necessary – only a valid account in the system is sufficient.

An attacker can gain unauthorized access to vaults and entries managed by Devolutions Server, including potentially stored passwords, keys, and other sensitive authentication data. It is also possible to approve requests from other users, which leads to a violation of the integrity of the access control process throughout the organization.

Devolutions Server must be updated to a version newer than 2025.2.12.0 according to the manufacturer's recommendations described in advisory DEVO-2025-0015 available at https://devolutions.net/security/advisories/DEVO-2025-0015/

Devolutions Server version 2025.2.12.0 and earlier