The vulnerability is a missing authorization in the entry status management feature of Devolutions Server. It allows a non‑administrator authenticated user, by sending a crafted status change request, to bypass the administrator‑enforced Pending Approval flow and obtain the data of the targeted entry. This flaw enables unauthorized disclosure of sensitive information stored in entries that would normally require administrative approval to be viewed. The weakness type is Missing Authorization (CWE‑862).

Devolutions Server versions 2025.3.20.0 and all releases up to 2026.1.16.0 are affected. Any deployment of these versions that has non‑administrator users who can interact with the status change endpoint is at risk.

Because the flaw only requires authentication and the ability to submit a status change request, any regular user with appropriate network access to the server can exploit it. No public exploit is currently known, and the EPSS score is not available, but the absence of authorization control raises the likelihood of misuse. The CVSS score is 5.4. The vulnerability is not listed in the CISA KEV catalog, yet its potential for data leakage makes it a high‑priority concern for organizations using Devolutions Server.