CVE-2023-1603

Published: Apr 2, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry permission via id collision.

Affected (1)

Products: Devolutions: Devolutions Server

Devolutions

1 product

Devolutions Server

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	Before 2023.1.3.0

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://devolutions.net/security/advisories/DEVO-2023-0008

Source: security@devolutions.net

Vendor Advisory

https://devolutions.net/security/advisories/DEVO-2023-0008

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.