This vulnerability involves an authorization bypass in the entry duplication feature of Devolutions Server. An authenticated user with write permissions to any vault can exploit this flaw to access documentation and attachments from entries in vaults they are not authorized to access. The issue affects multiple versions of Devolutions Server, specifically 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability is classified under CWE-639, which relates to authorization bypass through user-controlled keys. No CVSS score or vendor remediation details are currently available.

An attacker with write access to any vault can bypass authorization controls to copy sensitive documentation and attachments from vault entries they should not have access to. This could lead to unauthorized disclosure of confidential information stored in restricted vaults. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict write access to vaults to trusted users only and monitor for unusual activity related to entry duplication requests.