An improper access control flaw in the user and role restore API endpoints allows a low‑privileged authenticated user to restore previously deleted users and roles by sending crafted API requests. This mis‑directed access can re‑enable a removed user account or re‑assign a role that was intended to be permanently revoked, thereby potentially granting the attacker privileges or access that should have been denied. The vulnerability is a permission bypass rather than a remote code execution flaw, but it enables persistence and privilege escalation within the affected system.

Devolutions Server version 2025.3.11.0 and earlier. The flaw exists in the API endpoints responsible for restoring deleted users and roles.

The CVSS score of 5.9 indicates moderate risk, while an EPSS score of less than 1% shows a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation. Attacks would require an authenticated session with a low‑privileged account and crafted API calls, making it a relatively focused threat rather than a broad remote attack vector.