CVE-2025-0691: Devolutions Server · Improper Access Control
Affects Devolutions ServerSource CVE Database V5
Not known to be exploited · CVSS 5.0 Medium.
Data as of 26 Oct 2026, 10:12 UTC
- EPSS
- 0.3% chance of exploitation in 30 days – higher than 24% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:NExploitation evidence
Disclosed: evidence found.
CVE published 5 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Devolutions Server | Affected
| Fixed in– |
AI-suggested
European organizations should implement the following specific mitigation steps: 1) Immediately audit current permission settings within Devolutions Server to detect any unauthorized changes. 2) Restrict authenticated user roles to the minimum necessary privileges, especially limiting access to permission management functions. 3) Monitor logs for unusual permission modification activities or access patterns that could indicate exploitation attempts. 4) Apply strict network segmentation and access controls to limit which users can reach the Devolutions Server interface. 5) Enforce multi-factor authentication (MFA) for all users with permission editing capabilities to reduce risk from compromised credentials. 7) Consider implementing server-side validation enhancements or compensating controls to prevent client-side bypasses. 8) Educate administrators and users about the risks of client-side validation reliance and encourage reporting of suspicious behavior. These steps go beyond generic advice by focusing on privilege minimization, monitoring, and compensating controls specific to the nature of this vulnerability.
Description
Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.