Insufficient Information Protection in Devolutions Server by Devolutions

CVE-2026-114485

What is CVE-2026-114485?

The vulnerability in Devolutions Server allows authenticated users with delegated view permissions to access sensitive information, specifically MFA secrets, of all users. This issue arises from inadequate security measures in the user list API response, potentially leading to unauthorized exposure of confidential data. Organizations utilizing versions 2026.3.10.0 and earlier of Devolutions Server should review their security protocols and consider patching immediately.

References