What is the CVSS score of EUVD-2026-44367?

EUVD-2026-44367 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-44367?

Yes, a patch is available for EUVD-2026-44367. Update the affected software to the latest version immediately.

Devolutions Server EUVD-2026-44367

| CVE-2026-15058 LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-14 DEVOLUTIONS

GHSA-vpcp-4q2f-h32p

Authentication Bypass Server Devolutions

3.1

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

3.1 LOW

Network-exploitable IDOR requiring authenticated access (PR:L) and message ID discovery (AC:H); impact is deletion-only with no confidentiality or availability consequence.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:34 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

3.1 (LOW)

Patch available

Jul 14, 2026 - 23:20 EUVD

CVE Published

Jul 14, 2026 - 18:11 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.

AnalysisAI

Improper authorization in Devolutions Server's secure messages deletion endpoint exposes an Insecure Direct Object Reference (IDOR) flaw allowing any authenticated user to permanently delete secure messages belonging to other users simply by supplying a target message identifier. Affected versions are 2026.2.11 and 2026.1.22; patched releases 2026.1.23 and 2026.2.12 are available per the vendor advisory. No public exploit identified at time of analysis, and the low CVSS score of 3.1 reflects constrained impact (integrity only, no data disclosure) paired with high attack complexity.

Technical ContextAI

CWE-639 (Authorization Bypass Through User-Controlled Key) describes a classic IDOR pattern: the server verifies the caller is authenticated but fails to confirm the caller is authorized to act on the specific resource instance identified by the user-supplied key. In this case, the secure messages deletion endpoint in Devolutions Server accepts a message identifier in the request without validating ownership, allowing any authenticated session to reference and delete an arbitrary message object. The affected CPE is cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, covering the Devolutions Server application - an enterprise privileged access management and password vault platform.

RemediationAI

Upgrade Devolutions Server to version 2026.1.23 or later (for 2026.1.x deployments) or to version 2026.2.12 or later (for 2026.2.x deployments), as confirmed by the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0024/. If immediate patching is not feasible, a compensating control is to disable or restrict access to the secure messages feature for non-administrative users through role-based access controls within Devolutions Server, accepting the trade-off that legitimate secure message use will be impacted. Additionally, audit deletion event logs for anomalous cross-user message deletion activity to detect potential exploitation in the interim. No workaround eliminates the underlying authorization flaw short of patching.