Sicherheit & Compliance
Höchste Standards zum Schutz Ihrer Daten und zur Gewährleistung von Vertrauen.
DEVO-2026-0041
Devolutions Server is affected by multiple vulnerabilities.
Betroffene Produkte
Änderungsprotokoll
Initial publication - 2026-11-11
Insertion of sensitive information into sent data in user endpoints
6.9 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.
CVE(s)
CVE-2026-126328
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Improper access control on the autofill vault search
6.5 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.
CVE(s)
CVE-2026-126332
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Danksagungen
godsensei
Improper access control on connection history
5.3 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Improper access control in the connection history in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.
CVE(s)
CVE-2026-126327
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Insertion of sensitive information into sent data in the user list endpoint
5.1 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.
CVE(s)
CVE-2026-126331
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Improper access control on administrative role assignments
4.9 Medium - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.
CVE(s)
CVE-2026-126326
Behebung und Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher.
Danksagungen
GSN_Ligma