The vulnerability is a missing authorization check in the PAM AD computer import endpoint of Devolutions Server. An authenticated user who is not an administrator but holds a PAM license can send a crafted import request and create PAM sub-providers under existing Active Directory providers. This activity bypasses intended user restrictions, allowing the user to alter security policies and potentially elevate their influence over the PAM infrastructure.

Devolutions Server versions 2026.3.5.0 through 2026.3.10.0 and all 2026.2.20.0 releases and earlier are affected. The issue resides within the PAM AD computer import functionality exposed by the server endpoint.

The CVSS score is 4.3, indicating a moderate severity. The EPSS score is < 1% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated non-administrative user with a PAM license, implying an internal or compromised account as the primary attack vector. The ability to create sub-providers can lead to unauthorized configuration changes and broaden attack surfaces within the managed environments.