Technical impact
The vulnerability is a missing authorization check in the data source settings API of Devolutions Server. An authenticated user who is not an administrator can send a specifically crafted API request that returns integration secrets, thereby compromising the confidentiality of sensitive configuration data. This flaw maps to the information‑disclosure weakness addressed by CWE‑200.
Affected Systems
The affected product is Devolutions Server. Versions 2026.3.5.0 and all earlier releases contain the flaw because the data source settings API lacks proper authorization controls. Users running these versions are susceptible to secret disclosure.
Risk and Exploitability
The flaw carries a CVSS score of 6.5, indicating moderate severity. The EPSS score is not available, and the vulnerability has not been listed in CISA’s KEV catalog, so the exploitation likelihood is uncertain but not negligible. An attacker must be authenticated and have non‑administrative privileges; from that position, a crafted API request can exfiltrate integration secrets. The vulnerability is exploitable via the network if the API endpoint is reachable, making it a potential inside threat or a threat for compromised user credentials.
