This vulnerability (CVE-2026-5146) in Devolutions Server arises from missing authorization checks in the notification management endpoints. Specifically, the server fails to validate session information properly, enabling unauthenticated attackers to modify or delete user notification records arbitrarily. Affected versions include Devolutions Server 2026.1.6.0 through 2026.1.15.0 and all versions 2025.3.19.0 and earlier. The CVSS v3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and limited confidentiality impact. No official fix or patch has been documented as of the publication date.

An attacker without authentication can alter or delete user notification records on affected Devolutions Server instances. The impact is limited to confidentiality loss of notification data; integrity and availability impacts are not indicated. There are no known active exploits in the wild. The vulnerability could potentially disrupt user notification functionality but does not appear to compromise broader system integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, organizations should monitor vendor communications for updates. Until a fix is available, restricting access to the notification management endpoints and applying network-level controls to limit exposure may reduce risk. Avoid exposing the affected server publicly if possible.