The vulnerability identified as CVE-2026-10787 in Devolutions Server involves a missing authorization check in the API that handles deleted user groups. This flaw permits an authenticated user with low privileges to send crafted API requests to enumerate metadata about deleted user groups, potentially exposing sensitive information. The issue affects Devolutions Server version 2026.2.4.0 and earlier, including 2026.1.20.0. The CVSS score is 4.3 (medium severity), reflecting low attack complexity but limited impact on confidentiality and no impact on availability or system integrity. No vendor advisory or patch information is currently available.

An authenticated low-privileged user can enumerate metadata of deleted user groups, which may lead to information disclosure. There is no indication of impact on confidentiality of active data, integrity, or availability. The vulnerability does not allow privilege escalation or remote code execution based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the API to trusted users and monitor for unusual API requests related to deleted user groups. Avoid granting unnecessary privileges to users who do not require access to user group metadata.