An authenticated user lacking administrative privileges but possessing the user-group membership management permission can send a specially crafted API request to the role membership management endpoint in Devolutions Server. Because the endpoint does not properly enforce access control, the request escalates the user’s rights to that of an administrator. The flaw is a classic example of improper role-based access control (CWE-863), allowing compromise of confidentiality, integrity and availability of the system.

Devolutions Server versions 2026.2.4.0 through 2026.2.12.0, as well as all releases from 2026.1.23.0 and earlier, are vulnerable.

The CVSS score for this vulnerability is 8.8 and the EPSS score is < 1%. The vulnerability is not listed in the CISA KEV catalog. Nevertheless, the vulnerability permits local privilege escalation within the application, a high-risk outcome for exposed or compromised environments. The likely attack path involves authenticating to the API with a non-admin account that has the relevant permission, then sending a crafted request to the endpoint. Because the flaw is driven by a misconfigured permission set, it can be exploited by anyone who gains legitimate authentication with the minimal privilege set.