A critical authorization bypass vulnerability in Devolutions PowerShell Universal allows authenticated users to perform unauthorized, privileged actions across the platform.

This flaw, categorized under CWE-862 (Missing Authorization), stems from insufficient permission validation on gRPC service endpoints. Any authenticated user possessing a valid token can circumvent access controls to read sensitive data, manipulate resources, or cause service disruption.

The vulnerability carries a CVSS score of 8.3, reflecting a high potential for unauthorized data access and integrity compromise. Successful exploitation could allow a malicious insider or a compromised account to escalate privileges, leading to the exfiltration of sensitive configuration data or the destruction of critical automation resources within the environment.

Immediate Action: Upgrade to PowerShell Universal version 2026.1.4 or later immediately to resolve the missing authorization checks.

Proactive Monitoring: Review gRPC request logs for unusual traffic patterns or access requests originating from accounts that should not have administrative or high-level access.

Compensating Controls: Implement strict network segmentation and ensure that access to the PowerShell Universal management interface is restricted to authorized personnel via VPN or Zero Trust access controls.

Public Exploit Available: No — no confirmed public exploit exists for this vulnerability.

Given the severity of the access control bypass and the potential for privilege escalation, organizations utilizing PowerShell Universal must prioritize this update. Administrators should verify their current version and apply the patch as part of the standard emergency maintenance cycle to maintain the security posture of their automation and management infrastructure.