Devolutions Server versions 2026.3.5.0 and earlier contain a missing authorization check in the gateway network scan token API. The flaw allows an authenticated user with low privileges to craft a request, receive a network scan token, and then use that token to perform internal network discovery and port scanning through the gateway. This exposes the internal topology, open services, and potential vulnerabilities, providing valuable reconnaissance for further exploitation.

Devolutions Server 2026.3.5.0 and all earlier releases of this product are affected.

The vulnerability carries a CVSS score of 5, indicating a moderate risk level. An attacker must first authenticate with a low‑privileged account, but once authenticated, can experiment with the gateway to enumerate internal hosts and services. The EPSS score is not available and the issue is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. Given the required authentication, the threat is primarily to internal network visibility rather than immediate data exfiltration or direct system compromise.