CVE-2026-114485
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user vi…
Published: 2026-10-22 · CVSS: Unscored
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7