Improper access control in Devolutions Server's entry activity log feature allows an authenticated user who has view rights on an entry, but lacks permission to retrieve activity logs, to obtain those logs through a crafted API request. This can lead to disclosure of audit information and potentially reveal internal user actions without authorization. The vulnerability is a classic improper access control flaw (CWE‑284).

Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and all 2025.3.20.0 releases and earlier are affected. The product is identified as Devolutions Server by the vendor Devolutions.

The vulnerability requires an authenticated session and access to a specific entry but no special user privileges. An attacker can exploit it by sending a crafted API request targeting the activity log endpoint. The CVSS score of 4.3 indicates moderate severity, yet the nature of the flaw suggests potential privacy and audit integrity risks. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, indicating no publicly known exploitation at this time. The attack surface is confined to the internal API, but the impact on privacy and audit integrity is significant.