CVE-2025-4433

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.1.7.0 and earlier

Description The issue is related to improper access control in user group management. A non-administrative user with both User Management and User Group Management permissions can perform privilege escalation by adding users to groups with administrative privileges.

Recommendations For Devolutions Server versions 2025.1.7.0 and earlier, restrict access to the User Group Management feature for non-administrative users until a fix is available. Consider removing the User Group Management permission from non-administrative users to minimize the risk of exploitation.