CVE-2026-120716: Security vulnerability

Published Nov 3, 2026

Updated

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

Event History

Nov 3, 2026

CVE Published

via MITRE·08:40 PM

Data Sourced

via MITRE·08:40 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user must have the delegated permission to update users from the identity provider. Users without that delegated permission are not described as able to access the affected synchronization API response.

What information could be exposed through the synchronization API?

The response can disclose other users' MFA secrets during identity provider user synchronization.

Which deployments are affected?

Devolutions Server 2026.3.13.0 and earlier are affected. The issue is specifically in identity provider user synchronization.

CVE-2026-120716: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed through the synchronization API?

Which deployments are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be exposed through the synchronization API?

Which deployments are affected?