Devolutions Server versions 2026.1.14.0 and earlier contain an access control vulnerability (CWE-862) in the vault documentation feature. Authenticated attackers can exploit this flaw by crafting API requests to read documentation content from vaults they should not have access to. This indicates missing or insufficient authorization checks in the API endpoints responsible for serving vault documentation. No patch or official remediation level has been disclosed by the vendor as of the publication date.

An authenticated attacker can access documentation content from unauthorized vaults, potentially exposing sensitive information stored in the vault documentation. This unauthorized disclosure could lead to information leakage within an organization using the affected Devolutions Server versions. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Devolutions Server to trusted users only and monitor for unusual API activity related to vault documentation requests. Follow vendor updates closely for any forthcoming patches or mitigations.