CVE-2026-15058
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
An improper authorization vulnerability in the secure messages deletion endpoint of Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
Risk Assessment
The organization risks loss of confidentiality and integrity of internal communications, as an attacker can deliberately delete other users' messages, potentially disrupting operations or hiding evidence.
Recommendation
Immediately update Devolutions Server to a patched version and implement user-based access controls for message management endpoints.
Original NVD description (English source)
Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.