This vulnerability (CVE-2026-6706) in Devolutions Server is caused by missing authorization checks in the vault documentation feature. An authenticated attacker with limited privileges can exploit this flaw by sending a specially crafted API request to access documentation content from vaults they should not have permission to view. The affected versions range from 2026.1.6.0 through 2026.1.14.0 and through 2025.3.18.0. The CVSS v3.1 base score is 6.5 (medium), reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. No official patch or remediation guidance has been provided by the vendor at this time.

An attacker with valid authentication can read sensitive documentation content from unauthorized vaults, potentially exposing confidential information. The confidentiality impact is high, but the vulnerability does not affect integrity or availability of the system. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected Devolutions Server versions and monitor for suspicious API requests related to vault documentation access. Avoid granting unnecessary privileges to users to limit potential exploitation.