CVE-2026-110806CWE-863broken-access-control

CVE-2026-110806

Medium · published October 16, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-16T18:17Z
Affected products (2)
ProductVersionsFixed in
devolutions/devolutions_server< 2026.2.20.02026.2.20.0
devolutions/devolutions_server≥ 2026.3.5.0, < 2026.3.10.02026.3.10.0
References (1)
https://devolutions.net/security/advisories/DEVO-2026-0036/ · [email protected]
EPSS history
Timeline
  • 18 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 16 OCT 13:44Z
    Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain…
    cvelistv5
  • 16 OCT 13:44Z
    Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain…
    cvelistv5