What is the CVSS score of CVE-2026-4925?

CVE-2026-4925 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Server CVE-2026-4925

EUVD-2026-17925 MEDIUM

Missing Authorization (CWE-862)

2026-04-01 DEVOLUTIONS

Authentication Bypass Server

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 01, 2026 - 15:30 euvd

EUVD-2026-17925

Analysis Generated

Apr 01, 2026 - 15:30 vuln.today

CVE Published

Apr 01, 2026 - 15:02 nvd

MEDIUM 5.0

DescriptionCVE.org

Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request.

This issue affects Server: from 2026.1.6 through 2026.1.11.

AnalysisAI

Improper access control in Devolutions Server 2026.1.6 through 2026.1.11 allows authenticated users to bypass administrator-enforced MFA restrictions and remove their own multi-factor authentication via a crafted request. This authentication bypass undermines security policies designed to enforce MFA compliance, enabling threat actors with valid credentials to disable a critical security control and potentially maintain persistent access without secondary authentication verification. No public exploit code or active exploitation has been confirmed at time of analysis.

Technical ContextAI

The vulnerability stems from inadequate authorization checks (CWE-862: Missing Authorization) in Devolutions Server's MFA management functionality. The application fails to properly validate that user requests to modify MFA configurations comply with administrator-enforced policies. Devolutions Server is a privileged access management and credential storage solution that manages authentication policies across enterprise environments. The affected versions 2026.1.6 through 2026.1.11 contain this flaw in the users MFA feature, which typically handles secondary authentication factors. The weakness allows an authenticated user context to bypass policy-level restrictions that should restrict MFA removal to authorized administrators only.

RemediationAI

Organizations should immediately upgrade to Devolutions Server version 2026.1.12 or later, which contains the remediation for this authorization bypass. Users running affected versions (2026.1.6 through 2026.1.11) should prioritize this update within their change management process. Until patched, administrators should monitor and audit MFA configuration changes through Devolutions Server's activity logs and implement supplementary access controls restricting API endpoints related to MFA modification to trusted networks or VPN access. Review the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0010 for comprehensive remediation guidance and version validation steps.