high8.8
CVE-2025-4433
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and …
Impact
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Devolutions | Devolutions Server | before 2025.1.9.0 |