An incorrect authorization check in Devolutions Gateway token generation allows an authenticated non‑administrative user to include wildcard destinations in a signed token. This defect permits the user to bypass the Network Access Rules configured for a virtual gateway and reach hosts that are normally denied, potentially exposing internal resources to unauthorized access.

The vulnerability affects Devolutions Server, specifically version 2026.3.10.0 and all earlier releases. Users of these builds should verify their installed version against this range.

The CVSS score of 4.3 and an EPSS score of < 1% indicate moderate severity and low likelihood of exploitation. However, the issue is actionable: an attacker only needs valid non‑admin credentials to craft a malicious token. No known public exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog, yet the potential for internal network compromise is significant. With correct authentication, an attacker can bypass the gateway’s Network Access Rules and reach normally denied hosts, essentially elevating privileges within the gateway’s network scope.