A missing authorization check in Devolutions Server's API that deletes user groups allows an attacker who has already authenticated with a low‑privileged account to request information about groups that have been deleted, exposing metadata that should be protected. This flaw does not provide code execution but can reveal sensitive structure or identifiers that may assist subsequent attacks. The weakness is identified as CWE-862.

Devolutions Server versions 2026.2.4.0, 2026.1.20.0 and earlier are affected. The vulnerability resides in the server product supplied by Devolutions.

The public EPSS score is not available and the issue is not listed in the CISA KEV catalog, indicating no documented active exploitation at this time. Based on the description, it is inferred that the vulnerability can be exercised via the exposed API, suggesting a network attack vector. While the severity is not quantified with a CVSS score, the potential to gain additional privilege through metadata enumeration warrants timely remediation.