CVE-2026-12117CWE-200

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login…

Medium · published June 16, 2026

CVSS v3.1
4.3
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

Improper access control in the social login connection endpoint in

Devolutions Server 2026.2.5 allows an authenticated vault member to

enumerate social login entry metadata to which they are not authorized

via a crafted API request.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-06-16T18:25Z
EPSS history
Timeline
  • 16 JUN 18:25Z
    Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login…
    cvelistv5