Rizalyeswehack

**Name of the Vulnerable Software and Affected Versions** Devolutions Server versions prior to 2026.3.5.1 **Description** Missing authorization in the attachment history API allows an authenticated low-privileged user to permanently delete or restore vault attachments by sending a crafted API request. **Recommendations** Update Devolutions Server to version 2026.3.5.1 or later.

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.