This vulnerability (CWE-863) in Devolutions Server affects the access request status endpoint, where insufficient authorization checks permit a low-privileged authenticated user to approve their own pending access request without going through the designated approver. This bypasses intended access control workflows and could lead to unauthorized privilege escalation within the system. The affected versions explicitly mentioned are 2026.2.11 and 2026.1.22. No CVSS score or vendor remediation information is currently available.

An attacker with low-level authenticated access can escalate their privileges by self-approving access requests that normally require higher-level approval. This undermines the access control mechanisms and could lead to unauthorized access to sensitive resources or administrative functions within Devolutions Server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint to trusted users only and monitor for suspicious access request approvals. Avoid granting unnecessary access permissions to low-privileged users.