Description
Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected products
- Devolutions / Server2026.1.6.0 – 2026.1.14.0
- Devolutions / Server0 – 2025.3.18.0
References
- VENDOR_ADVISORYhttps://devolutions.net/security/advisories/DEVO-2026-0011