Devolutions PowerShell Universal Missing Authorization Vulnerability in gRPC Service Endpoints

A vulnerability in Devolutions PowerShell Universal in versions prior to 2026.1.4 allows authenticated users with valid tokens to bypass role-based access controls on multiple gRPC service endpoints. This oversight enables users to perform privileged actions such as accessing sensitive information, managing resources (including creation and deletion), and disrupting service operations by sending crafted gRPC requests.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data, improper management of resources, and disruption of service operations.

Remediation

Users are advised to upgrade to Devolutions PowerShell Universal version 2026.1.4 or later.