This vulnerability (CWE-841) in Devolutions Server allows an authenticated user to bypass the audit notification mechanism when accessing sealed sensitive data entries. The flaw lies in the improper enforcement of the sealed-entry workflow, enabling retrieval of sensitive data without generating an unseal audit event. Affected versions include Devolutions Server 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. No official patch or remediation guidance has been published yet.

The impact is that sensitive data can be accessed by an authenticated user without triggering audit notifications that would normally alert administrators to such access. This reduces the effectiveness of monitoring and auditing controls, potentially allowing unauthorized or unnoticed data access. There is no indication of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should review access controls and monitor for unusual API usage patterns related to sealed entries. No vendor advisory or official remediation information is currently provided.