This vulnerability involves missing authorization controls in the vault import functionality of Devolutions Server 2026.1.16.0 and earlier. Specifically, a low-privileged authenticated user can craft an import request that bypasses intended access restrictions, enabling them to create new vaults without proper permissions. The issue is categorized under CWE-284 (Improper Access Control). No CVSS score or detailed vendor remediation information is currently available.

The impact is unauthorized creation of vaults by low-privileged users, which could lead to unauthorized data storage or manipulation within the Devolutions Server environment. There is no information about exploitation in the wild or further privilege escalation. The absence of a patch or official remediation guidance means the vulnerability remains unmitigated at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vault import feature to trusted users only and monitor for suspicious vault creation activities. Avoid granting unnecessary authentication privileges to users who do not require vault import capabilities.