The vulnerability stems from improper access control in the partial connection API of Devolutions Server versions 2026.3.5.0 and earlier. An authenticated low‑privileged user can issue a crafted API request that allows the user to read, create, modify, and delete entries in the System Vault. Because the System Vault stores sensitive credentials and secrets, this capability effectively gives the attacker unauthorized access to confidential information and the ability to alter or remove critical data, potentially disrupting service or facilitating further attacks. The weakness corresponds to CWE‑862: Broken Access Control. The likely attack vector is via a crafted API request to the partial connection endpoint, which an authenticated user can exploit.

Affected systems include Devolutions Server 2026.3.5.0 and all earlier releases. Users operating with low‑privileged accounts on these versions have the capability to manipulate the System Vault through the exposed API. No specific vendor‑supplied patch or workaround is listed in the advisory, so affected installations remain vulnerable until an updated release is applied.

Because any authenticated user with low privileges can manipulate the vault, the potential impact is significant: confidentiality, integrity, and availability of stored secrets may be compromised, and compromised vault entries could facilitate lateral movement or credential theft. The CVSS score is 5.4, and the EPSS score is < 1%; however, the absence of a KEV listing does not mitigate the risk of exploitation. Attacks would proceed by authenticating as a legitimate user and issuing malicious requests to the vulnerable API, so organizations should consider the urgency of applying patches or restricting permissions.