CVE-2026-15058

Name of the Vulnerable Software and Affected Versions Devolutions Server version 2026.2.11 Devolutions Server version 2026.1.22

Description Improper authorization in the secure messages deletion endpoint allows an authenticated user to delete messages belonging to other users. This is achieved through a direct object reference to the message identifier, a scenario where an application provides direct access to objects based on user-supplied input without sufficient authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.