CVE-2026-114485

Published: Ott 22, 2026 Last Modified: Ott 22, 2026
ExploitDB:
Other exploit source:
Google Dorks:

Description

AI Translation Available

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 
2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

201

Insertion of Sensitive Information Into Sent Data

Draft
Abstraction: Base Structure: Simple
Common Consequences
Security Scopes Affected:
Confidentiality
Potential Impacts:
Read Files Or Directories Read Memory Read Application Data
Applicable Platforms
All platforms may be affected
View CWE Details
https://devolutions.net/security/advisories/DEVO-2026-0037/
https://devolutions.net/security/advisories/DEVO-2026-0037/