The vulnerability is a missing authorization check in the PAM AD computer import endpoint of Devolutions Server. An authenticated user who is not an administrator but holds a PAM license can send a crafted import request and create PAM sub-providers under existing Active Directory providers. This activity bypasses intended user restrictions, allowing the user to alter security policies and potentially elevate their influence over the PAM infrastructure.

Devolutions Server versions 2026.3.5.0 through 2026.3.10.0 and all 2026.2.20.0 releases and earlier are affected. The issue resides within the PAM AD computer import functionality exposed by the server endpoint.

The CVSS score is not provided, but the presence of a privilege escalation vector strongly suggests a high severity impact. The EPSS value is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated non-administrative user with a PAM license, implying an internal or compromised account as the primary attack vector. The ability to create sub-providers can lead to unauthorized configuration changes and broaden attack surfaces within the managed environments.