This vulnerability lies in the MFA management API of Devolutions Server. Because the API lacks proper authorization checks, a logged‑in attacker can issue crafted HTTP requests that delete any MFA factor associated with their own account. Removing these factors reverts the account to single‑factor password protection, thereby increasing the attacker’s chance of credential compromise. The weakness is a missing permission check, classified as CWE‑862.

Devolutions Server versions from 2026.1.6 through 2026.1.11 are affected. No other products or versions are mentioned in the advisory.

The CVSS score of 5 indicates moderate severity, and the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session; the attacker can then delete MFA factors with a simple crafted HTTP request. Reducing MFA increases the risk of credential theft, making this a notable risk that should be addressed promptly.