This vulnerability (CWE-862) in Devolutions PowerShell Universal affects versions 2026.2.2 and earlier. It allows an authenticated user assigned only the Reader role, which normally has limited permissions, to execute automation tests and alter workflow properties. The root cause is missing server-side authorization checks, enabling privilege escalation within the application’s automation and workflow management features. No CVSS score or detailed exploit information is currently available, and no patch or official remediation has been disclosed by the vendor.

An authenticated user with minimal privileges (Reader role) can perform actions beyond their intended access level, such as executing automation tests and modifying workflow properties. This could lead to unauthorized changes in automation processes and workflows, potentially disrupting operations or enabling further misuse within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Reader role assignments to trusted users only and monitor for unusual activity related to automation tests and workflows. Follow vendor updates closely for any forthcoming patches or official mitigations.