CVE-2026-126327: Infoleak
Published Nov 11, 2026
·Updated
Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.
Event History
Nov 11, 2026
CVE Published
via MITRE·09:21 PM
Data Sourced
via MITRE·09:21 PM
DescriptionWeakness
Data Sourced
via NVD·10:17 PM
DescriptionWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
The attacker must be authenticated to Devolutions Server. The issue affects users who do not have permission to view passwords but can access the connection history API.
2
What information could be exposed?
Historical entry passwords may be obtained through the connection history API.
3
How can I determine whether a user may be affected?
Review authenticated users that can access the connection history API, particularly accounts lacking permission to view passwords. Those accounts may still be able to retrieve historical entry passwords.