Devolutions Server contains an improper access control flaw in its notification management endpoints. The flaw permits an unauthenticated actor to alter or remove any user’s notification records because the endpoints do not enforce session validation. This breach of access control, identified as CWE‑862, leads to an integrity compromise of notification data and can potentially disrupt user communication flows or enable further malicious activity.

The vulnerability is present in Devolutions Server versions 2026.1.6.0 through 2026.1.15.0, as well as in the 2025.3.19.0 release and all earlier 2025.x versions. Systems running any of these releases are affected.

The CVSS score of 4.3 and EPSS score of < 1% indicate a moderate severity and low exploitation likelihood, and the vulnerability is not listed in CISA’s KEV catalog. The lack of authentication requirements and the absence of session checks imply that a remote attacker can exploit the flaw from any network position that can reach the vulnerable endpoints. Because the flaw allows arbitrary modification or deletion of notification data without privileges, the risk to affected systems is significant, particularly if notification data is used in security or operational contexts.