CVE-2026-126332: Security vulnerability
Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.
Event History
Frequently Asked Questions
Which users are exposed to this issue?
Authenticated users who have only view permission on a shared entry may be able to retrieve that entry's password in clear text. The issue involves users who can create a linked credential entry in their private vault.
What does an attacker need to exploit it?
An attacker needs an authenticated account, view permission on a shared entry, and the ability to create a linked credential entry in their private vault.
How can I determine whether my deployment is affected?
Devolutions Server 2026.3.13.0 and earlier is affected. Review whether users with view-only access to shared entries can create linked credential entries in private vaults.