This vulnerability (CWE-862) in Devolutions Server affects the attachment history API, where insufficient authorization checks allow authenticated users with low privileges to perform unauthorized permanent deletion or restoration of vault attachments. The affected versions are all releases prior to 2026.3.7.0. The CVSS 3.1 base score is 5.4, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An authenticated user with low privileges can abuse the attachment history API to permanently delete or restore vault attachments without proper authorization. This could lead to unauthorized modification of sensitive data stored in vault attachments, impacting data integrity and availability. Confidentiality is not affected according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix link is provided, users should monitor Devolutions' advisories for updates. Until a fix is available, restrict access to the attachment history API to trusted users only and consider additional access controls or monitoring for suspicious API activity.