1. Home
  2. CVE Database
  3. CVE-2025-11957
HIGH · 8.4

CVE-2025-11957

Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of oth...

Vulnerability Description

Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.

CVSS Score

8.4

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
LOW

Affected Products

VendorProductVersions
DevolutionsDevolutions Server< 2025.2.14.0

Related Weaknesses (CWE)

CWE-639

References

FAQ

What is CVE-2025-11957?

CVE-2025-11957 is a vulnerability with a CVSS score of 8.4 (HIGH). Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of oth...

How severe is CVE-2025-11957?

CVE-2025-11957 has been rated HIGH with a CVSS base score of 8.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2025-11957?

Check the references section above for vendor advisories and patch information. Affected products include: Devolutions Devolutions Server.