This vulnerability (CWE-639) in Devolutions Server affects the secure messages deletion endpoint, where insufficient authorization validation enables an authenticated user to delete messages of other users by manipulating the message identifier parameter. This represents an authorization bypass through user-controlled keys, potentially leading to unauthorized data deletion.

An attacker with valid authentication can delete messages of other users, potentially causing data loss or disruption of communication within the affected Devolutions Server instances. There is no indication of remote code execution or privilege escalation beyond message deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the message deletion functionality to trusted users and monitor for suspicious deletion activities. Avoid sharing message identifiers or exposing them in untrusted contexts.