An access control flaw in Devolutions Server’s ticketing integration settings allows an authenticated low‑privileged user to craft a specific API request that returns the integration’s cleartext username and password. The vulnerability is classified as CWE‑312, indicating that sensitive information is being stored or transmitted in an unencrypted form, enabling attackers to obtain credentials that could be leveraged against linked ticketing platforms or other services.

Vulnerable are Devolutions Server 2026.2.4.0 and all prior releases back through 2026.1.20.0. Only the server product is affected; other Devolutions offerings are not listed.

The flaw requires authentication, so it is not a remote unauthenticated attack, but any low‑privileged user can trigger it over the network. No EPSS data is available and the vulnerability is not listed in CISA KEV, indicating no known public exploits. Nonetheless, exposure of ticketing credentials poses a high‑risk threat, as adversaries could immediately gain access to external ticketing systems, potentially leading to broader compromise.