Devolutions Server CVE-2025-11957

Requires a valid authenticated 'basic user' account on Devolutions Server (PR:L) and that the temporary access (just-in-time vault approval) workflow is in use. The attacker crafts API requests to self-approve their own temporary access request or approve other users' requests, defeating the approver authorization check in the temporary access workflow, thereby gaining access to vaults and entries beyond their assigned permissions. Limiting factors: only versions 2025.2.12.0 and earlier are affected; a pre-existing low-privilege account is mandatory (no anonymous/unauthenticated path); and the AC:H/AT:P metrics indicate additional request-crafting or timing conditions must be met, so exploitation is not fully reliable.

The CVSS 4.0 base score of 9.0 (Critical) is driven almost entirely by impact: successful abuse exposes stored vault credentials (VC:H/VI:H) with downstream consequences for the systems those secrets protect (SC:H/SI:H). However, several signals pull real-world urgency down. Exploitation requires an existing authenticated account (PR:L) - the attacker must already be a legitimate 'basic user' or have compromised one - so this is an insider/privilege-escalation issue rather than a remote-unauthenticated breach. The CVSS vector also carries AC:H and AT:P, indicating the crafted-request attack is not trivially reliable and has additional preconditions. Corroborating this, EPSS is only 0.33% (24th percentile), there is no CISA KEV listing, and no public exploit is identified. The signals are therefore consistent rather than conflicting: a genuinely high-impact authorization flaw whose practical exploitation is gated by prior authenticated access and request-crafting complexity. For organizations running Devolutions Server with the temporary-access workflow this is a real, patch-worthy priority (especially against insider threat and post-compromise lateral movement), but it is not a mass-exploitation / drive-by risk at this time.

A low-privileged 'basic user' (a legitimate insider or an attacker who has phished/compromised such an account) submits a temporary access request to a privileged vault, then issues a crafted API call to approve their own request - or another user's - bypassing the required approver authorization check, and reads the stored credentials and entries. No public exploit code is identified at time of analysis, and the AC:H/AT:P metrics imply the crafted request must meet specific conditions to succeed.