This vulnerability (CVE-2026-11890) affects Devolutions Server versions 2026.2.5 and 2026.1.21. It is caused by improper access control in the PAM account discovery functionality, which permits an authenticated user with limited privileges to access account discovery scan results that should be restricted. The issue is categorized under CWE-882 (Improper Access Control) and CWE-284 (Improper Access Control). The CVSS v3.1 base score is 4.3 (medium severity) with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, and limited confidentiality impact. There is no vendor advisory or patch information available at this time.

An authenticated user with limited privileges can retrieve account discovery scan results that they should not be authorized to access. This could lead to unauthorized disclosure of information related to account discovery scans. There is no indication of impact on integrity or availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user permissions to minimize exposure to the PAM account discovery feature. Monitor vendor communications for updates on patches or official mitigations.