Missing authorization checks on multiple gRPC service endpoints in Devolutions PowerShell Universal before version 2026.1.4 allow an authenticated user with any valid token to bypass role‑based access controls and perform privileged operations—reading sensitive data, creating or deleting resources, and disrupting service operations. Key detail from vendor description: "Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role‑based access controls and perform privileged operations…" These unauthorized operations confer elevated privileges (CWE‑862).

Affected vendor/product: Devolutions PowerShell Universal. All releases prior to 2026.1.4 are impacted. No more granular version information is provided.

The CVSS score of 8.3 indicates high severity. The EPSS score of less than 1% suggests a low likelihood of exploitation in the near term, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with a valid token; any token can bypass role‑based controls and trigger privileged gRPC calls, enabling both remote and local attackers that obtain a token to achieve privilege escalation.