CVE-2026-12117 — Devolutions / Devolutions Server

CVE-2026-12117

Devolutions / Devolutions Server PUBLISHED

Description (CNA)

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

Affected (CNA)

Vendor / product	Versions
Devolutions / Devolutions Server	affected 2026.2.0 before 2026.2.5

CWE

CWE-200

References

https://devolutions.net/security/advisories/DEVO-2026-0017/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.