Devolutions Server exposes plaintext credential secrets through its PAM password history API endpoints when an authenticated user attempts to access them with insufficient privileges. The flaw is an improper access control violation (CWE-639) that allows users who do not possess elevated permissions to retrieve sensitive data that should be restricted to administrators. Successful exploitation results in the disclosure of usernames and passwords, compromising user accounts and potentially the underlying systems they access.

The vulnerability affects Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and all releases of 2026.1.23.0 and earlier. No publicly available information indicates whether newer releases contain a fix.

With a CVSS score of 4.3, Devolutions Server API access control flaw falls into the medium severity range. Combined with an EPSS score of less than 1%, the likelihood of real‑world exploitation is considered low. The vulnerability is not listed in the CISA KEV catalog. Attackers likely exploit the flaw by sending crafted API requests to the password‑history endpoints after authenticating with a low‑privilege account. The primary exposure is plaintext credentials of other users.