CVE-2026-114485CWE-201

CVE-2026-114485

published October 22, 2026

CVSS
—
EPSS
0%
Percentile
3.0
In the wild
Unconfirmed
What it is

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server

2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00140 · 3.0th percentile
Weakness
CWE-201 · Insertion of Sensitive Information Into Sent Data
Published
2026-10-22T20:17Z
References (1)
https://devolutions.net/security/advisories/DEVO-2026-0037/ · [email protected]
EPSS history
Timeline
  • 24 OCT 03:52Z
    EPSS moved — → 0%
    epss
  • 22 OCT 15:37Z
    Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlier allows an authenticated attacker with…
    cvelistv5
  • 22 OCT 15:37Z
    Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlier allows an authenticated attacker with…
    cvelistv5