The vulnerability is an incorrect authorization logic in the add‑on property handling of Devolutions Server. A user who has only View permission can access unredacted add‑on properties that are included in connection data, thereby revealing stored add‑on passwords that should be protected. This flaw aligns with CWE‑863, the improper authorization weakness, and allows the compromised credentials to be read by an authenticated but minimally privileged user.

Devolutions Server versions 2026.3.8.0 and all earlier releases are affected. The issue is confined to the add‑on property component that supplies connection data to clients.

The CVSS score of 6.5 signifies a moderate severity. Exploitation requires the attacker to be an authenticated user with View–only rights, after which they can invoke normal server operations to retrieve the leaked add‑on properties. The EPSS score is not provided, and the vulnerability is not listed in the CISA KEV catalog, which suggests no known public exploitation yet. Any user with View permissions that should not have access to sensitive add‑on data remains at risk of credential disclosure.