Devolutions Server Entry Status Management Authorization Bypass Vulnerability

An authorization bypass vulnerability has been identified in the entry status management feature of Devolutions Server. This issue allows non-administrator authenticated users to circumvent the Pending Approval process enforced by administrators. Affected users can access an entry's data by sending a crafted status change request. The vulnerability is present in Devolutions Server versions 2026.1.6.0 through 2026.1.16.0, as well as in versions 2025.3.20.0 and earlier.

Impact

Exploitation of this vulnerability allows unauthorized access to entry data by bypassing the administrator-required Pending Approval process.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.19.0 or higher, or version 2025.3.22.0 or higher.