Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2026-0041
Devolutions Server is affected by multiple vulnerabilities.
Affected Products
Change Log
Initial publication - 2026-11-11
Insertion of sensitive information into sent data in user endpoints
6.9 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.
CVE(s)
CVE-2026-126328
Remediation and Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Improper access control on the autofill vault search
6.5 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.
CVE(s)
CVE-2026-126332
Remediation and Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Credits
godsensei
Improper access control on connection history
5.3 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Improper access control in the connection history in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.
CVE(s)
CVE-2026-126327
Remediation and Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Insertion of sensitive information into sent data in the user list endpoint
5.1 Medium - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier and 2026.2.23.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.
CVE(s)
CVE-2026-126331
Remediation and Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher, Devolutions Server 2026.2.24.0 or higher.
Improper access control on administrative role assignments
4.9 Medium - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request.
CVE(s)
CVE-2026-126326
Remediation and Workarounds
Upgrade to Devolutions Server 2026.3.14.0 or higher.
Credits
GSN_Ligma