CVE-2026-6706: Medium severity Devolutions Devolutions Server vulnerability
Published Apr 28, 2026
·Updated
Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request.
This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.
Affected Software
3 affected components
Devolutions Devolutions Server>=2026.1.6.0<=2026.1.14.0, <=2025.3.18.0
Devolutions Devolutions Server<2025.3.19.0
Devolutions Devolutions Server>=2026.1.6.0<2026.1.15.0
Event History
Apr 28, 2026
CVE Published
via MITRE·01:11 PM
Data Sourced
via MITRE·01:11 PM
DescriptionWeakness
Data Sourced
via NVD·02:16 PM
DescriptionSeverityWeaknessAffected Software
Mar 29, 58312
Event
via FIRST·11:37 PM
Frequently Asked Questions
1
What is the severity of CVE-2026-6706?
CVE-2026-6706 is classified as a medium severity vulnerability.
2
How do I fix CVE-2026-6706?
To fix CVE-2026-6706, upgrade Devolutions Server to version 2026.1.15.0 or later.
3
What does CVE-2026-6706 allow an attacker to do?
CVE-2026-6706 allows an authenticated attacker to read documentation content from unauthorized vaults.
4
What versions of Devolutions Server are affected by CVE-2026-6706?
Devolutions Server versions up to and including 2026.1.14.0 are affected by CVE-2026-6706.
5
What exploitation method is used in CVE-2026-6706?
CVE-2026-6706 can be exploited via a crafted API request.