Devolutions PowerShell Universal versions 2026.3.4 and earlier contain an incorrect privilege assignment vulnerability in the app token management component. This flaw allows an authenticated user with token creation or update permissions to escalate their privileges to administrator. Additionally, in multi-node deployments, a revoked app token can be reinstated by crafting app token requests that set arbitrary roles or revocation states.