CVE-2026-12117
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In Devolutions Server 2026.2.5, improper access control in the social login connection endpoint allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized.
Risk Assessment
The organization may be exposed to the disclosure of social login metadata information, potentially leading to further attacks or privacy breaches.
Recommendation
It is recommended to update to the latest version of Devolutions Server and implement appropriate access controls to prevent unauthorized access to metadata.
Other vulnerabilities in Devolutions Server 2026.2.5
See all- CVE-2026-17570Medium
In Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and version 2026.1.23.0 and earlier, improper access control in the PAM password history endpoints allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.
- CVE-2026-17569Medium
An improper access control vulnerability in the NetBox synchronizer in Devolutions Server. An authenticated user with view-only permission can obtain a stored API token.
- CVE-2026-17568High
An improper access control vulnerability in Devolutions Server allows an authenticated non-administrative user with user-group membership management permission to escalate privileges to administrator via a crafted API request. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier.
- CVE-2026-15642Low
In Devolutions Server 2026.1.22.0 and 2026.2.11.0, the Recovery Kit response file generation feature inserts sensitive information into a file. This allows an attacker with access to the generated file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.
- CVE-2026-15641High
An improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request by directly calling the request status endpoint, bypassing the required approver review.
- CVE-2026-15637High
An improper authorization vulnerability in Devolutions Server allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. The issue affects the PAM SSH key and certificate retrieval endpoints.
- CVE-2026-15058Low
An improper authorization vulnerability in the secure messages deletion endpoint of Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
- CVE-2026-14536High
In Devolutions Server 2026.2.9.0, improper enforcement of a mandatory multi-factor authentication (MFA) policy was found. An attacker with valid user credentials can bypass the MFA Required policy and authenticate without completing multi-factor authentication. The issue occurs when DVLS encounters an invalid default MFA value.
- CVE-2026-12755Low
A vulnerability in Devolutions Server versions 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host. By crafting a DomainName parameter in the PAM AD discovery endpoints, the attacker can capture PAM provider credentials as an NTLMv2 challenge-response.
- CVE-2026-12105Medium
Improper access control in Devolutions Server 2026.2.5 and 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.
Original NVD description (English source)
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.