CVE-2026-5175 - AskarLabs CVE Database

CVE-2026-5175

Vendor Devolutions

Product Server

Weakness CWE-862 · Missing authorization

Published April 1, 2026

Last update April 1, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11.

Key dates

02Disclosure timeline

April 1, 2026 CVE published

April 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-5175 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2023-47836 WordPress WP Meta and Date Remover plugin <= 2.3.0 - Broken Access Control vulnerability CVE-2025-62078 WordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerability CVE-2025-39390 WordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerability CVE-2025-24594 WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerability CVE-2025-68542 WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerability