This vulnerability (CVE-2026-17570) in Devolutions Server arises from improper access control in the PAM password history API endpoints. Authenticated users with low privileges can exploit this flaw by sending specially crafted API requests to disclose plaintext credential secrets. The affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier. The issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No vendor advisory or patch information is currently available, and the vulnerability has not been reported as exploited in the wild.

An authenticated low-privileged user can bypass access controls to retrieve plaintext credential secrets from the PAM password history endpoints. This could lead to unauthorized disclosure of sensitive credential information, potentially facilitating further unauthorized access or privilege escalation within the affected environment. The CVSS score of 4.3 reflects a medium impact primarily on information disclosure with limited integrity or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the PAM password history endpoints to trusted users only and monitor for unusual API request patterns. Avoid granting unnecessary privileges to users who do not require access to sensitive credential data.