Devolutions Server Improper Access Control Vulnerability in Ticketing Integration Settings

A vulnerability exists in Devolutions Server in the ticketing integration settings, where improper access control allows an authenticated low-privileged user to retrieve cleartext credentials for ticketing integrations. This is achieved through a crafted API request. The vulnerability affects Devolutions Server versions 2026.2.4.0, as well as all versions through 2026.1.20.0.

Impact

Exploitation of this vulnerability could lead to unauthorized access to cleartext credentials for ticketing integrations, potentially allowing for further exploitation or misuse of those credentials.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.2.5.0 or higher, or 2026.1.21.0 or higher.