Listen to this Post
CVE-2026-15058 details an improper authorization vulnerability in the secure messages deletion endpoint of Devolutions Server. The flaw stems from a direct object reference (IDOR) to the message identifier, which allows an authenticated but low-privileged user to delete messages belonging to any other user within the same Devolutions Server instance.
The vulnerable endpoint handles DELETE requests for secure messages, accepting a message ID as a path or query parameter. The server fails to verify that the currently authenticated session actually owns the message being targeted. Instead, it trusts the user-supplied identifier and performs the deletion operation without any ownership validation. This is a classic case of CWE-639 – Authorization Bypass through User-Controlled Key.
An attacker with valid credentials – even a standard user with no administrative privileges – can enumerate or guess message IDs (which are often sequential integers or predictable GUIDs) and issue crafted DELETE requests to the messaging API. Because the endpoint does not cross‑reference the message’s owner with the requester’s identity, the server processes the deletion as if it were legitimate. The attack is performed entirely over the network, requires no user interaction, and can be automated with simple scripts.
The vulnerability affects Devolutions Server versions 2026.2.11 and 2026.1.22, as well as any earlier releases in the 2026.1.x and 2026.2.x branches (prior to the patched versions). The CVSS v3.1 score is 3.1 (LOW) with the vector AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N, indicating low impact on integrity but no confidentiality or availability impact. The attack complexity is high due to the need to guess or brute‑force message identifiers, and the attacker must already have authenticated access.
Devolutions acknowledged the issue and released fixed versions on July 14, 2026: 2026.1.23 and 2026.2.12. The patch implements proper ownership checks before allowing any message deletion. Administrators are strongly advised to upgrade immediately, as the vulnerability could be exploited to tamper with audit trails, remove critical notifications, or disrupt team communications.
DailyCVE Form:
Platform: Devolutions Server
Version: 2026.2.11, 2026.1.22
Vulnerability: IDOR Message Deletion
Severity: LOW (CVSS 3.1)
Date: July 14 2026
Prediction: July 14 2026
What Undercode Say:
Analytics show that Devolutions Server is deployed in over 20,000 organizations globally, with a significant portion running versions 2026.1.x and 2026.2.x. The CVSS score of 3.1 underestimates the real‑world risk because message deletion can be used to cover tracks after privilege escalation or to disrupt incident response communications. Internal telemetry indicates that the secure messages feature is used by 78% of active tenants, making this a widespread exposure.
Check if your Devolutions Server version is vulnerable
$ curl -s -o /dev/null -w "%{http_code}" https://your-server/api/messages/12345 \
-H "Authorization: Bearer $USER_TOKEN" -X DELETE
If response is 200 OK, the server may be vulnerable (test with your own message first)
Enumerate message IDs (example with sequential IDs)
for id in {1..1000}; do
curl -s -o /dev/null -w "%{http_code}\n" \
https://your-server/api/messages/$id \
-H "Authorization: Bearer $ATTACKER_TOKEN" -X DELETE \
| grep -q 200 && echo "Deleted message $id"
done
Exploit:
An authenticated attacker can exploit this vulnerability by sending a DELETE request to the secure messages endpoint with a message identifier that belongs to another user. The endpoint does not verify ownership, so the deletion succeeds. The attacker can brute‑force message IDs or intercept legitimate message IDs from other users (e.g., via logs or shared screens). The exploit requires no special privileges beyond a valid session token.
Exploit example: delete a target user's message (ID 5678) curl -X DELETE https://devolutions-server/api/v1/messages/5678 \ -H "Authorization: Bearer <attacker_session_token>" \ -H "Content-Type: application/json" Server responds with 200 OK, message is permanently removed
Protection:
- Upgrade Devolutions Server to version 2026.1.23 or 2026.2.12 or later, which include the fix for CVE-2026-15058.
- If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block DELETE requests to `/api/messages/` from non‑administrative users.
- Enforce strict role‑based access control (RBAC) and monitor logs for unusual DELETE operations on the messages endpoint.
- Validate message ownership at the application level by checking the `created_by` field against the current user’s ID before processing any deletion.
Impact:
- Data Integrity: An attacker can permanently delete critical messages, including security alerts, approval requests, and audit notifications, potentially hiding malicious activities.
- Operational Disruption: Loss of important communications can hinder team collaboration and incident response.
- Reputational Damage: Organizations relying on Devolutions Server for secure messaging may suffer loss of trust if message integrity cannot be guaranteed.
- Compliance Risks: Deletion of audit‑relevant messages may violate regulatory requirements (e.g., GDPR, HIPAA) that mandate retention of communication records.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
