Listen to this Post
How the mentioned CVE works: In Devolutions Server versions before 2025.2.21 and 2025.3.9, a critical authorization flaw allows non-administrative users to access email service credentials. This vulnerability stems from inadequate permission checks in the code handling email configuration requests. When users, even with low privileges, interact with specific API endpoints or web interfaces related to email settings, the server fails to enforce role-based access controls. Consequently, sensitive data such as SMTP usernames and passwords are exposed in server responses. The issue originates from a misconfigured conditional statement in the authorization layer that incorrectly grants access to credential retrieval functions. Attackers can exploit this by crafting simple HTTP GET requests to endpoints like /api/email/config, where the system returns full configuration details without redaction. This exposure is particularly dangerous because it enables credential theft without requiring advanced exploits, potentially leading to unauthorized email usage, data breaches, and further network compromise. The flaw was patched by adding proper validation to ensure only administrative users can view or modify email service credentials.
Platform: Devolutions Server
Version: Before 2025.2.21
Vulnerability: Email credential exposure
Severity: Critical
Date: 11/27/2025
Prediction: Patch released 2025.2.21
What Undercode Say:
Analytics:
bash: curl -s http://target/api/email/config | jq .credentials
bash: grep -o “smtp://[^ ]” /opt/devolutions/config.json
code: function getEmailConfig(user) { if (!user.isAdmin) { return emailConfig; } }
How Exploit:
Send HTTP GET to /api/email/config using low-privilege user credentials to retrieve exposed SMTP credentials.
Protection from this CVE:
Update to version 2025.2.21. Implement strict access controls. Audit user permissions regularly.
Impact:
Unauthorized email access, spam campaigns, data exfiltration, reputational damage.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
