CVE-2026-110806: Devolutions Devolutions Server vulnerability
Published Oct 16, 2026
·Updated
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
Affected Software
1 affected component
Devolutions Devolutions Server<=2026.3.8.0
Event History
Oct 16, 2026
CVE Published
via MITRE·01:44 PM
Data Sourced
via MITRE·01:44 PM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated Devolutions Server user who has only View permission can exploit it. The issue affects users who can access connection data for add-ons.
2
What information could be exposed?
Add-on passwords can be obtained because connection data returns unredacted add-on properties to users with View permission.
3
Which versions are affected?
Devolutions Server 2026.3.8.0 and earlier are affected.