This vulnerability (CWE-862) in Devolutions Server arises from missing authorization checks in the entry status management feature. Specifically, non-administrator authenticated users can bypass the Pending Approval workflow enforced for administrators by sending a crafted status change request. This flaw enables unauthorized access to data entries that should be restricted until approved by an administrator. Affected versions include Devolutions Server 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. No patch or official remediation guidance is currently available, and the product is not a cloud service.

An authenticated user without administrative privileges can bypass intended approval controls and access sensitive entry data prematurely. This undermines the access control model and could lead to unauthorized disclosure of sensitive information managed by Devolutions Server. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users carefully and monitor for unusual status change requests. Avoid granting unnecessary authenticated access to untrusted users. Follow vendor communications for updates on patches or official mitigations.