CVE-2026-90969: Devolutions Devolutions Server vulnerability

Q: Who can exploit this issue?

An authenticated Devolutions Server user who does not have the view-password permission can exploit it. The issue is exposed through the vault entry listing feature.

Q: What does an attacker need to do to obtain passwords?

The attacker must send a request to the entry listing endpoint that includes password disclosure parameters. Successful exploitation can return vault passwords in cleartext.

Q: Which versions are affected?

Devolutions Server 2026.2.16 and earlier are affected.

Published Sep 15, 2026

Updated

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters.

Affected Software

1 affected component

Devolutions Devolutions Server<=2026.2.16

Event History

Sep 15, 2026

CVE Published

via MITRE·07:09 PM

Data Sourced

via MITRE·07:09 PM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated Devolutions Server user who does not have the view-password permission can exploit it. The issue is exposed through the vault entry listing feature.

What does an attacker need to do to obtain passwords?

The attacker must send a request to the entry listing endpoint that includes password disclosure parameters. Successful exploitation can return vault passwords in cleartext.

Which versions are affected?

Devolutions Server 2026.2.16 and earlier are affected.