Missing authorization in the vault import feature allows a low‑privileged authenticated user to create new vaults through a crafted import request. This flaw enables the user to create vaults that the system normally restricts, effectively granting elevated data‑storage permissions and potentially compromising confidentiality or integrity by allowing unauthorized data persistence.

Devolutions Server 2026.1.16.0 and all earlier releases are affected.

The vulnerability can be exploited by any authenticated user without special privileges, requiring only a crafted import request. No public exploit has been reported yet, and the EPSS score is not available, but the lack of authorization check indicates a clear path to privilege escalation. The CVSS score of 4.3 indicates moderate severity. The flaw is not listed in the CISA KEV catalog, suggesting it is still early in its lifecycle but could be a moderate-impact issue for organizations relying on rigorous access controls.