This vulnerability (CWE-862) in Devolutions Server involves missing authorization checks in the user profile update functionality. Authenticated users integrated via Active Directory can exploit this flaw by sending crafted API requests to alter their own profile attributes. The affected product versions include Devolutions Server 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. There is no indication of known exploits in the wild or an official remediation at this time.

An authenticated Active Directory user can modify their own profile attributes without proper authorization checks. This could potentially lead to unauthorized changes in user profile data, which might affect application behavior or user privileges depending on how profile attributes are used internally. There is no evidence of privilege escalation beyond the user's own profile or broader system compromise from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the user profile update API to trusted users only and monitor for unusual profile modification activity. Avoid granting excessive permissions to Active Directory users in the affected versions.