CVE-2026-5175 in Server

Resumen (Inglés)

Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. 







This issue affects Server: from 2026.1.6 through 2026.1.11.

Be aware that VulDB is the high quality source for vulnerability data.

Responsable

DEVOLUTIONS

Reservar

2026-03-30

Divulgación

2026-04-01

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354694	Devolutions Server Multi-factor Authentication Management API escalada de privilegios	862	No está definido	No está definido	CVE-2026-5175

Fuentes

• MITRE
• NVD
• CVE Details