CVE-2026-126328: Security vulnerability

Published Nov 11, 2026

Updated

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.

Event History

Nov 11, 2026

CVE Published

via MITRE·09:23 PM

Data Sourced

via MITRE·09:23 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionWeakness

Frequently Asked Questions

Which users can exploit this issue?

An attacker must be authenticated and have delegated permissions to view users. The issue affects the user API responses available to those users.

What sensitive data could be exposed?

Affected user API responses can disclose users' MFA shared secrets.

How can I determine whether my deployment is affected?

Devolutions Server 2026.3.13.0 and earlier is affected. Review which accounts have delegated user-viewing permissions, as those accounts may be able to retrieve MFA shared secrets through the user API.

CVE-2026-126328: Security vulnerability

Event History

Frequently Asked Questions

Which users can exploit this issue?

What sensitive data could be exposed?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What sensitive data could be exposed?

How can I determine whether my deployment is affected?