Devolutions Server contains an access control vulnerability in its ticketing integration settings that permits authenticated users with low privileges to access cleartext credentials for configured ticketing integrations. This occurs through a crafted API request exploiting improper access control mechanisms. The affected versions include 2026.2.4.0 and earlier. The vulnerability relates to CWE-312, indicating cleartext storage of sensitive information. No CVSS score or remediation level has been published, and no patch links are available.

An attacker with low-level authenticated access to Devolutions Server can obtain sensitive credentials stored in cleartext for ticketing integrations. This could lead to unauthorized access to integrated ticketing systems or further lateral movement depending on the credentials obtained. However, exploitation requires authentication, and no public exploits are currently known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the Devolutions Server to trusted users only and monitor for suspicious API requests related to ticketing integration settings. Avoid granting unnecessary privileges to users who do not require access to ticketing integrations.