This vulnerability in Devolutions Server involves incorrect authorization in the role membership management endpoint. Specifically, an authenticated user who is not an administrator but has the permission to manage user-group memberships can exploit this flaw by sending a crafted API request to escalate their privileges to administrator level. The affected versions include Devolutions Server 2026.2.4.0 through 2026.2.12.0 and versions 2026.1.23.0 and earlier. No official remediation or patch information is currently provided by the vendor, and no known exploits in the wild have been reported.

Successful exploitation results in privilege escalation from a non-administrative user to an administrator, potentially allowing full control over the Devolutions Server environment. This can lead to complete compromise of the server, including unauthorized access to sensitive data and administrative functions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user permissions to minimize the assignment of user-group membership management rights to only trusted administrators. Monitor for unusual API requests related to role membership management.