Devolutions Server versions 2025.3.14 and earlier store sensitive user account information in plain text within the database, exposing a sensitive data exposure flaw. An adversary who can access the database can directly read this information, compromising confidentiality of user credentials and personal data. The vulnerability is classified as CWE-312.

The issue exists in Devolutions Server 2025.3.14 and earlier releases. No specific edition or deployment type is mentioned, but the affected product is the Devolutions Server database component.

The CVSS base score of 4.9 indicates moderate severity, and the EPSS figure of less than 1% suggests that exploitation is unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have database access, either through local compromise or poorly secured credentials, and does not depend on remote network components.