Devolutions Server Authorization Bypass Vulnerability in Entry Duplication Feature

An authorization bypass vulnerability has been identified in the entry duplication feature of Devolutions Server. This issue allows an authenticated user with write access to any vault to duplicate documentation and attachments from an entry in a vault they cannot access, by sending a crafted save request. The vulnerability affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0, as well as versions 2025.3.20.0 and earlier.

Impact

Exploitation of this vulnerability could lead to unauthorized access to documentation and attachments from entries in restricted vaults.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.19.0 or higher, or 2025.3.22.0 or higher.