CVE-2025-2278: Devolutions Server

Medium severity, CVSS 6.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these requests via a known request ID.

Affected products

• Devolutions Devolutions Server: before 2025.1.3.0 (fixed in 2025.1.3.0)

Published 2025-03-13. Last modified 2026-06-17.