This vulnerability involves improper access control in the Pluggable Authentication Module (PAM) account discovery feature of Devolutions Server versions 2026.2.5 and 2026.1.21. Authenticated users can access account discovery scan results that should be restricted, potentially exposing sensitive information. The vulnerability is classified under CWE-882 (Improper Access Control). No CVSS score or vendor remediation details are available yet.

An authenticated user can retrieve account discovery scan results that may contain sensitive information. This could lead to unauthorized disclosure of internal account details within the Devolutions Server environment. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the authenticated user context.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected versions and limit authenticated user privileges to reduce exposure.