Skip to content
OpenAdvisories
Medium · 5.3 CVE-2026-8694 EUVD-2026-36438GHSA-23xj-gqpq-c6g6

Improper access control on the API documentation endpoint in PowerShell Universal

Published Jun 12, 2026 · Updated Jun 12, 2026 · Assigned by DEVOLUTIONS

Vendor: Devolutions Product: PowerShell Universal

Description

Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.

Affected products

VendorProductAffectedFixed
Devolutions PowerShell Universal ≤ 2026.1.7 —

References