CVE-2026-8694

Improper access control on the API documentation endpoint in PowerShell Universal PUBLISHED

Description (CNA)

Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.

Affected (CNA)

Vendor / product	Versions
Devolutions / PowerShell Universal	affected 0 through 2026.1.7

CWE

CWE-306

References

https://devolutions.net/security/advisories/DEVO-2026-0016/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.