CVE-2026-114485: Devolutions Devolutions Server vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker must be authenticated and have delegated user view permissions. No higher privilege requirement is stated in the available information.

Q: Which users' MFA secrets may be exposed?

An attacker meeting the permission requirement can obtain the MFA secrets of all users through the user list API response.

Q: How can an organization determine whether it may be affected?

Organizations using Devolutions Server 2026.3.10.0 or earlier should review accounts with delegated user view permissions and assess whether those accounts could access the user list API.

Published Oct 22, 2026

Updated

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

Affected Software

1 affected component

Devolutions Devolutions Server<=2026.3.10.0

Event History

Oct 22, 2026

CVE Published

via MITRE·03:37 PM

Data Sourced

via MITRE·03:37 PM

DescriptionWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker must be authenticated and have delegated user view permissions. No higher privilege requirement is stated in the available information.

Which users' MFA secrets may be exposed?

An attacker meeting the permission requirement can obtain the MFA secrets of all users through the user list API response.

How can an organization determine whether it may be affected?

Organizations using Devolutions Server 2026.3.10.0 or earlier should review accounts with delegated user view permissions and assess whether those accounts could access the user list API.