CVE-2026-10786

Analyzed Analyzed - Analysis Complete

Improper Access Control in Devolutions Server Exposes Ticketing Credentials

Publication date: 2026-06-08

Last updated on: 2026-06-12

Assigner: Devolutions Inc.

Description

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-08

Last Modified

2026-06-12

Generated

2026-06-29

AI Q&A

2026-06-08

EPSS Evaluated

2026-06-27

NVD

CVE-2026-10786

EUVD

EUVD-2026-35182

Affected Vendors & Products

Vendor	Product	Version / Range
devolutions	devolutions_server	to 2026.1.21.0 (exc)
devolutions	devolutions_server	2026.2.4.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

CVE-2026-10786 is a security vulnerability in Devolutions Server versions 2026.2.4.0 and earlier, including 2026.1.20.0. It involves improper access control in the ticketing integration settings, which allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations by making a specially crafted API request.

Impact Analysis

This vulnerability can allow a low-privileged authenticated user to access sensitive cleartext credentials for ticketing integrations. This unauthorized access could lead to further compromise of integrated systems, unauthorized actions within ticketing systems, and potential data breaches.

Mitigation Strategies

To mitigate the risk of this vulnerability, users should upgrade Devolutions Server to version 2026.2.5.0 or higher, or 2026.1.21.0 or higher.

Compliance Impact

This vulnerability allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations, which could lead to unauthorized access to sensitive information.

Such unauthorized access to sensitive credentials may result in violations of compliance requirements under common standards and regulations like GDPR and HIPAA, which mandate strict controls over access to sensitive data and credentials.

Therefore, exploitation of this vulnerability could potentially lead to non-compliance with these regulations due to improper access control and exposure of sensitive authentication information.

Hi! I’m here to help you understand CVE-2026-10786. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70