Description
Improper
access control in the vault documentation feature in Devolutions
Server allows an authenticated attacker to read documentation content
from unauthorized vaults via a crafted API request.
This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | Server | 2026.1.6.0 – ≤ 2026.1.14.0, ≤ 2025.3.18.0 | — |
Advisories 1
- WID-SEC-2026-1303 Devolutions Server: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Apr 28, 2026