Improper input validation in the gateway health check feature of Devolutions Server enables an authenticated user with low privileges to issue crafted API requests. The vulnerability, identified as a Server‑Side Request Forgery (CWE‑918), permits the user to direct the server to request internal or external resources, which can lead to disclosure of sensitive information. The impact is limited to information exposure rather than code execution or denial of service.

The affected product is Devolutions Server, released by Devolutions. Vulnerable releases include versions 2026.1.1 through 2026.1.11 and 2025.3.1 through 2025.3.17. Any installation of these version ranges is susceptible.

The CVSS score of 4.3 indicates a moderate risk, and the EPSS score of less than 1 % suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires authentication but does not need elevated privileges, making it accessible to many users. The attack vector is inferred to involve sending a malicious API request to the health check endpoint, which then causes the server to perform unauthorized requests to target resources.