Missing authorization in the attachment history API, a flaw classified as CWE-862, allows an authenticated low-privileged user to permanently delete or restore vault attachments. By forging an API request, an attacker can alter or remove attachment data, compromising the integrity of stored content.

Devolutions Server component Devolutions:Server, specifically versions 2026.3.5.0 and earlier as noted in the advisory. All deployments of Devolutions Server that have not applied a fix beyond this version are affected.

The CVSS score of 5.4 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Based on the description, the attack requires only authenticated access; a low-privileged user can craft an API request to the /attachment-history endpoint to delete or restore attachments. The exploit path is relatively straightforward and can be executed with minimal effort once the user is authenticated, resulting in a moderate risk of integrity compromise.