CVE-2026-15058

—

CVSS 3.1

3.1 low

EPSS

<1%p11

Published

Jul 14, 2026 (Jul 14, 2026)

Modified

Jul 30, 2026

Description

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.