CVEvulnerability

CVE-2026-114485

Published 2026-10-22 Modified 2026-10-22 Official page ↗
Status
Awaiting Analysis
Published
2026-10-22
Last modified
2026-10-22
Assigner
[email protected]
Weaknesses
CWE-201

Description

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

Related

Weakness · CWE (1)

  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness

References