CVE-2026-120716

Awaiting Analysis Awaiting Analysis - Queue

Insertion of Sensitive Information in Devolutions Server Sync API

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Devolutions Inc.

Description

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-03

Last Modified

2026-11-03

Generated

2026-11-04

AI Q&A

2026-11-04

EPSS Evaluated

N/A

NVD

CVE-2026-120716

EUVD

EUVD-2026-116497

Affected Vendors & Products

Vendor	Product	Version / Range
Devolutions	Server	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves an authenticated user with delegated permissions exploiting a flaw in Devolutions Server 2026.3.13.0 and earlier. The issue allows them to insert sensitive data into synchronization requests, specifically targeting the identity provider user sync process. As a result, they can retrieve other users' multi-factor authentication (MFA) secrets through the synchronization API response.

Impact Analysis

If exploited, this vulnerability could allow an attacker to gain unauthorized access to other users' MFA secrets. This compromises the security of those accounts, potentially leading to unauthorized access to sensitive systems or data. Organizations using Devolutions Server could face data breaches or unauthorized account takeovers.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations that require protecting sensitive authentication data. A breach of MFA secrets may result in unauthorized access to personal or health data, triggering legal penalties, fines, or reputational damage for affected organizations.

Mitigation Strategies

Update Devolutions Server to a version later than 2026.3.13.0 to address the vulnerability. Ensure only authorized users have delegated permissions to update users from the identity provider.

Hi! I’m here to help you understand CVE-2026-120716. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...