CVE-2025-4433
HIGHDevolutions Server < 2025.1.9.0 - Privilege Escalation via User Group Management
Title source: llmDescription
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to perform privilege escalation by adding users to groups with administrative privileges.
References (1)
Core 1
Core References
Vendor Advisory
https://devolutions.net/security/advisories/DEVO-2025-0010/
Scores
CVSS v3
8.8
EPSS
0.0046
EPSS Percentile
36.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-284
Status
published
Products (1)
devolutions/devolutions_server
< 2025.1.9.0
Published
May 30, 2025
Tracked Since
Feb 18, 2026