CVE-2026-6706CWE-862

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from…

Medium · published April 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

Improper

access control in the vault documentation feature in Devolutions

Server allows an authenticated attacker to read documentation content

from unauthorized vaults via a crafted API request.

This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.3th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-04-28T13:11Z
EPSS history
Timeline
  • 28 APR 13:11Z
    Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from…
    cvelistv5