Devolutions Server has an improper access control flaw in the vault documentation feature that allows an authenticated attacker to read documentation content from vaults to which they are not authorized. The flaw is triggered by a crafted API request, enabling the disclosure of potentially sensitive documentation data. It is inferred that ownership and availability are not affected, as the vulnerability only permits data disclosure and does not alter system state.

The vulnerability affects Devolutions Server, specifically all instances running the 2026.1.14.0 release or earlier. No additional affected vendors or version ranges were identified in the advisory.

The impact is limited to information disclosure. It is inferred that the attacker must hold authenticated access because the flaw is triggered by a crafted API request; however, this prerequisite is not explicitly stated in the CVE description. The EPSS score of <1% indicates a low probability of exploitation, and the issue is not listed in CISA's KEV catalog, suggesting that widespread exploitation has not been observed. The CVSS score of 6.5 indicates moderate severity that still warrants timely remediation.