Missing authorization within Devolutions Server's global vault allows an authenticated user with only view permission to alter or remove global contact and folder records. The effect is the loss or corruption of critical directory data, leading to compromised integrity and potential operational disruptions.

Devolutions Server versions 2026.3.7.0 and earlier are impacted. These include all releases released before the issuance of this advisory.

The vulnerability requires valid credentials and a user role granted only the global vault view permission. Once accessed, the attacker can perform destructive changes to global vault entries. The EPSS score is < 1%, and it is not listed in CISA KEV, so the exact likelihood of exploitation is unclear, but missing authorization is a high‑severity weakness as reflected by the CVSS score of 7.1. Attacking this flaw does not require special hardware or software beyond normal access to the server.