CVE-2026-3638 - AskarLabs CVE Database

CVE-2026-3638

Vendor Devolutions

Product Server

Weakness CWE-862 · Missing authorization

Published March 9, 2026

Last update March 9, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.

Key dates

02Disclosure timeline

March 9, 2026 CVE published

March 9, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3638 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2024-37427 WordPress Timetics plugin <= 1.0.21 - Broken Access Control vulnerability CVE-2025-12955 Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure CVE-2025-1507 ShareThis Dashboard for Google Analytics <= 3.2.1 - Missing Authorization to Unauthenticated Feature Deactivation CVE-2023-26035 ZoneMinder vulnerable to Missing Authorization CVE-2026-7525 My Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter