The vulnerability resides in Devolutions Server's REST API endpoints, where an authenticated user possessing only view‑only rights can read sensitive connection data. This improper access control allows an attacker to exfiltrate confidential information that should be restricted to privileged users, compromising confidentiality and potentially exposing credentials used to connect to backend systems. The weakness is cataloged as CWE‑200, an information‑exposure flaw.

The flaw affects Devolutions Server releases 2025.3.14.0 and earlier. Any deployment of these versions that exposes the documented API endpoints to authenticated clients is susceptible. Organizations running older versions must verify and upgrade accordingly.

The CVSS score of 6.5 indicates a medium‑to‑high risk, while an EPSS score of less than 1% suggests that exploitation is currently rare. Because the flaw requires valid credentials, attackers need to compromise user accounts or acquire view‑only tokens, but once authenticated, they can immediately harvest sensitive data. The vulnerability is not listed in the CISA KEV catalog, so no prioritized exploitation is known, yet the potential damage warrants prompt remediation.