VULNERABILITY INTELLIGENCE

CVE-2026-12117

CVSS score4.3 MEDIUM
EPSS probability0.26%
CISA KEVNot currently listed
Published2026-06-16
Last modified2026-10-25
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

Weakness classification

  • security@devolutions.net: CWE-200
  • 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-200

Primary references