Improper Access Control in Devolutions Server 2026.2.5

Publication date: 2026-06-16

Last updated on: 2026-06-18

Assigner: Devolutions Inc.

Description

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-16

Last Modified

2026-06-18

Generated

2026-07-07

AI Q&A

2026-06-16

EPSS Evaluated

2026-07-05

NVD

CVE-2026-12117

EUVD

EUVD-2026-37202

Affected Vendors & Products

Vendor	Product	Version / Range
devolutions	devolutions_server	From 2026.2.4.0 (inc) to 2026.2.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability is an improper access control issue in the social login connection endpoint of Devolutions Server version 2026.2.5. It allows an authenticated vault member to access and enumerate social login entry metadata that they are not authorized to see by sending a specially crafted API request.

Impact Analysis

The impact of this vulnerability is that an authenticated user with vault access could gain unauthorized visibility into social login metadata entries. This could lead to information disclosure, potentially exposing sensitive data related to social login configurations that should be restricted.

Hi! I’m here to help you understand CVE-2026-12117. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70