Devolutions Server Insufficient Logging in Entry Export Feature Notification Bypass Vulnerability

A vulnerability exists in the entry export feature of Devolutions Server, specifically in versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. This vulnerability allows an authenticated user with export permissions to export a sealed entry without notifying administrators, by sending a crafted export request. The issue arises from inadequate logging when exporting sealed entries, which enables the bypass of the unseal notification workflow.

Impact

Exploitation of this vulnerability allows for the unseal notification to administrators to be bypassed when exporting sealed entries, potentially leading to unauthorized access to sensitive data without triggering the appropriate audit trail.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.19.0 or higher, or 2025.3.22.0 or higher.