What is the CVSS score of CVE-2026-5171?

CVE-2026-5171 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-5171

EUVD-2026-31460 MEDIUM

Improper Access Control (CWE-284)

2026-05-22 DEVOLUTIONS

GHSA-3q36-9rmf-ffj7

Authentication Bypass Server Devolutions

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable via API (AV:N), low complexity, requires authenticated session (PR:L); confidentiality impact limited to activity log metadata, no integrity or availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:39 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

May 22, 2026 - 15:28 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Devolutions Server's entry activity log feature fails to enforce per-permission authorization on its API layer, allowing authenticated users to retrieve audit trails for vault entries they can access but are explicitly denied log-viewing rights on. Affected are all Devolutions Server releases through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 through 2026.1.16.0. No public exploit code exists and EPSS sits at 0.03% (7th percentile), placing real-world exploitation risk firmly in the low tier despite the network-reachable attack vector.

Technical ContextAI

Devolutions Server is a privileged access management (PAM) and enterprise password vault platform. Its access control model distinguishes between entry access permissions and metadata permissions (such as viewing activity logs), allowing administrators to grant vault entry access while denying audit trail visibility. CWE-284 (Improper Access Control) identifies the root cause: the API endpoint responsible for returning activity log data for a given entry validates that the requestor has entry access but omits the secondary check for the log-viewing permission. The affected CPE (cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*) covers the full Devolutions Server application. The flaw is confined to the REST API layer; the UI enforces the permission correctly, meaning only direct API interaction exposes it.

RemediationAI

Upgrade Devolutions Server to a release beyond the affected ranges: for the 2026.1.x branch, apply any release after 2026.1.16.0; for deployments on 2025.3.x or earlier, upgrade to a patched release confirmed via the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/ - an exact fixed version is not independently confirmed from available data beyond what the advisory specifies. As a compensating control where immediate patching is not feasible, restrict API access to the activity log endpoints at the network perimeter or via reverse-proxy ACLs to known administrative source IPs, accepting the trade-off of reduced API accessibility for legitimate integrations. Additionally, audit current role assignments to ensure that users who should not view activity logs have not been granted that permission explicitly, narrowing the population of users who could exploit the bypass.