Improper Access Control in Devolutions Server Affects User Data Restriction
CVE-2026-12117

4.3MEDIUM

Key Information:

Vendor: Devolutions
Status: Devolutions Server
Vendor: CVE Published:; 16 June 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-12117?

A critical security flaw exists in Devolutions Server 2026.2.5 that permits authenticated vault members to exploit improper access control in the social login connection endpoint. This vulnerability allows unauthorized individuals to enumerate sensitive metadata related to social login entries by crafting specific API requests. This could lead to data exposure and unauthorized access, highlighting the importance of robust access controls in web applications.

Affected Version(s)

Devolutions Server 2026.2.0 < 2026.2.5

References

https://devolutions.net/security/advisories/DEVO-2026-0017/

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jun 16, 2026
Vulnerability Reserved
Jun 12, 2026

CVE-2026-12117 Data

JSON