This vulnerability in Devolutions Server arises from missing authorization checks in the entry documentation and attachment features. Authenticated users who have vault read access can exploit this flaw to access documentation and attachments of sealed entries, which should normally be restricted. The issue affects multiple versions of Devolutions Server, including 2026.1.6.0 through 2026.1.16.0 and earlier versions such as 2025.3.20.0. No CVSS score or official remediation information is available, and the product is not a cloud service, so remediation depends on vendor updates.

An authenticated user with vault read access can bypass intended access controls to retrieve sensitive documentation and attachments associated with sealed entries. This could lead to unauthorized disclosure of potentially sensitive information stored within the server. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict vault read access to trusted users only and monitor for unusual API request patterns that attempt to access sealed entry documentation or attachments.