EUVD-2026-36438
GHSA-23xj-gqpq-c6g6
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Information disclosure of OpenAPI spec maps to C:L, not I:L; no modification or availability impact applies; PR:N confirmed by unauthenticated description.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.
AnalysisAI
Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell Universal 2026.1.7 and earlier due to improper access control (CWE-306). Any network-reachable attacker without credentials can retrieve the full OpenAPI specification of internally defined REST APIs, exposing endpoint paths, parameters, and operational structure that administrators intended to be non-public. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low-complexity, zero-authentication network vector makes enumeration trivially automatable.
Technical ContextAI
PowerShell Universal, developed by Devolutions, is a platform for building and hosting REST APIs, dashboards, and automation scripts using PowerShell. It exposes an OpenAPI specification layer for user-defined REST endpoints - functionality intended for authenticated internal consumers. CWE-306 (Missing Authentication for Critical Function) identifies the root cause: the endpoint serving the OpenAPI schema for user-defined APIs does not enforce authentication, allowing any caller to retrieve the full interface contract. The CPE string cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:* indicates all editions and platforms of the product are affected through version 2026.1.7. OpenAPI specifications can reveal internal route naming conventions, expected parameter types, authentication schemes referenced in endpoint definitions, and operational logic inferences - all useful for pre-attack reconnaissance.
RemediationAI
Apply the vendor-released patch per Devolutions security advisory DEVO-2026-0016, available at https://devolutions.net/security/advisories/DEVO-2026-0016/. The specific fixed release version was not included in the available intelligence; consult the advisory directly to confirm the minimum safe version beyond 2026.1.7. As a compensating control for environments that cannot patch immediately, restrict network access to the PowerShell Universal instance using firewall rules or a reverse proxy that enforces authentication at the perimeter before requests reach the OpenAPI specification endpoints - this reduces exposure without modifying the application, but requires infrastructure changes. Alternatively, if PowerShell Universal's API gateway supports route-level authentication middleware, verify that the OpenAPI spec endpoint is explicitly included in protected routes rather than excluded by default. Do not rely on obscurity of endpoint paths alone, as that defense is eliminated by this vulnerability.
More in Powershell Universal
View allThe API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary comman
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creat
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with
PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing
The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the conf
Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, en
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system
authentication configuration in PowerShell Universal versions up to 2026.1.3 is affected by cleartext storage of sensit
PowerShell Universal versions before 4.5.6 and 5.6.13 contain a stored cross-site scripting vulnerability that allows un
PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoin
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today