The vulnerability arises from an improper access control condition in the multi‑factor authentication feature. An authenticated user can submit a crafted request that bypasses the administrator‑enforced restriction and deletes their own MFA configuration, eliminating a critical layer of security for the affected account. This weakness is classified as CWE‑862: Failure to Restrict the Type of Access.

Devolutions Server versions 2026.1.6 through 2026.1.11 are affected; the impacted product is the Devolutions Server privileged‑access management solution.

The CVSS score of 5 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the near future. The vulnerability is not listed in the CISA KEV catalog, implying it is not yet widely exploited. Exploitation requires a valid authenticated session; the attacker must send a crafted request to the MFA endpoint. Based on the description, it is inferred that the attack would be carried out via a remote network request within the application. Because the attack is limited to users who already have access to the system, the overall risk is contained to those accounts.