CVE-2026-12117: Infoleak
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If possible, disable the social login connection endpoint (social login feature) until a vendor patch is available to prevent enumeration via the API.
Devolutions Server social login connection endpoint social_login_connection_endpoint_enabled = false - Configuration
Restrict vault member permissions so they cannot query or enumerate social login entry metadata; apply least-privilege to roles that currently allow access to social login endpoints.
Devolutions Server vault_member_role_permissions = remove/enforce least privilege for social login metadata access - Compensating control
Restrict network access to the social login connection endpoint (or the server hosting it) using firewall rules, IP allowlists, VPN, or WAF rules so only trusted callers can reach the endpoint.
- Operational
Review API and access logs for calls to the social login connection endpoint for signs of crafted enumeration requests; investigate and remediate any suspicious activity (revoke sessions or access for impacted accounts).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12117?
CVE-2026-12117 has a medium severity rating of 4.3 on the CVSS scale.
What are the risks associated with CVE-2026-12117?
CVE-2026-12117 allows authenticated users to improperly access and enumerate unauthorized social login metadata.
How do I fix CVE-2026-12117?
To mitigate CVE-2026-12117, ensure proper access control mechanisms are in place for the social login connection endpoint.
When was CVE-2026-12117 published?
CVE-2026-12117 was published on June 16, 2026.
What software is affected by CVE-2026-12117?
CVE-2026-12117 affects Devolutions Server version 2026.2.5.