CVE-2026-126331: Security vulnerability

Published Nov 11, 2026

Updated

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.

Event History

Nov 11, 2026

CVE Published

via MITRE·09:24 PM

Data Sourced

via MITRE·09:24 PM

DescriptionWeakness

Data Sourced

via NVD·10:17 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated and have delegated permissions to view users. Those permissions allow access to the affected user list API response.

What information can be exposed?

The user list endpoint can return users' API key secret hashes to an authenticated user with delegated user-viewing permissions.

Which versions are affected?

Devolutions Server 2026.3.13.0 and earlier are affected.

CVE-2026-126331: Security vulnerability

Event History

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information can be exposed?

Which versions are affected?