Devolutions Server CVE-2026-5146

The primary exploitation condition is that an attacker must possess valid authentication credentials (PR:L in CVSS vector). However, the description states 'unauthenticated attacker,' which conflicts with the CVSS PR:L requirement. This discrepancy must be clarified with the vendor: if exploitation truly requires authentication, only low-privilege users can exploit this via authorized API access. If the description is accurate and unauthenticated access is possible despite the CVSS vector, then any network-connected attacker can exploit this without credentials. The notification management endpoints themselves must be exposed to the attacker's network (AV:N, no special network configuration needed). No user interaction is required (UI:N). The impact is confined to the user's session scope (S:U), meaning an attacker cannot escalate privileges or affect other systems. The limiting factors are: (1) authentication requirement (if CVSS PR:L is correct), (2) access limited to notification records only, and (3) no ability to execute code or achieve high-integrity impact.

This vulnerability presents a moderate but not critical risk. The CVSS base score of 4.3 with PR:L reflects that low-privileged authenticated users can read and modify notification data (Confidentiality Impact: Low, Integrity Impact: None, Availability Impact: None - which aligns with notification deletion capability). The EPSS score of 0.02% (percentile 4%) is extremely low, indicating minimal real-world exploitation probability despite public disclosure. This disconnect between moderate CVSS and very-low EPSS is notable: the attack vector is network-accessible and exploitation complexity is low, but the practical barriers (either PR:L authentication requirement or low attacker motivation for notification records) keep real exploitation uncommon. KEV status is not confirmed in the provided data. The tag 'Authentication Bypass' is somewhat misleading given the PR:L requirement in the CVSS vector - more accurately, this is an authorization bypass for low-privilege users within notification management. For most organizations, this is a low-priority patch candidate unless notification records contain sensitive business logic or personal data, or if the PR:L requirement is actually a misclassification and unauthenticated access is genuinely possible (which contradicts CVSS). Recommend confirming with vendor whether all affected endpoints require authentication or if any truly allow unauthenticated access.

A low-privilege employee of an organization running Devolutions Server crafts HTTP DELETE or POST requests directly against the notification management API endpoint (e.g., /api/notifications/{id}) using their own valid authentication token. Due to missing session validation, the server fails to verify that the employee has authorization to modify notifications belonging to other users. The attacker deletes or modifies notifications from executives or other departments, potentially disrupting workflow alerts or tamper with audit trails if notifications are used for compliance logging.