Insufficient Information Protection in Devolutions Server by Devolutions
CVE-2026-114485

4.3MEDIUM

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114485?

The vulnerability in Devolutions Server allows authenticated users with delegated view permissions to access sensitive information, specifically MFA secrets, of all users. This issue arises from inadequate security measures in the user list API response, potentially leading to unauthorized exposure of confidential data. Organizations utilizing versions 2026.3.10.0 and earlier of Devolutions Server should review their security protocols and consider patching immediately.

Affected Version(s)

Server 0 < 2026.3.11

References

https://devolutions.net/security/advisories/DEVO-2026-0037/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.