CVE-2026-100289 – Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.