CVE-2026-17569
Received Received - Intake

Improper Access Control in Devolutions Server Exposes API Tokens

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: Devolutions Inc.

Description
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-27
Last Modified
2026-07-27
Generated
2026-07-27
AI Q&A
2026-07-27
EPSS Evaluated
N/A
NVD
CVE-2026-17569
EUVD
EUVD-2026-49379

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
devolutions server 2026.2
devolutions server 2026.1
devolutions server From 2026.1.23.0 (inc) to 2026.2.12.0 (inc)
devolutions server to 2026.1.24.0 (exc)
devolutions server From 2026.2.14.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper access control issue in the NetBox synchronizer of Devolutions Server. An authenticated user with view-only permissions can exploit the partial connection endpoint to retrieve a stored API token.

Detection Guidance

Check Devolutions Server logs for suspicious access to the partial connection endpoint by view-only users. Review API token exposure in logs or database entries. Verify user permissions to ensure no unauthorized access occurred.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data if an attacker gains access to the API token. The impact includes potential data breaches or unauthorized actions within the system.

Compliance Impact

This vulnerability may lead to non-compliance with GDPR or HIPAA if sensitive data is exposed. Unauthorized access to API tokens could result in violations of data protection requirements.

Mitigation Strategies

Upgrade Devolutions Server to version 2026.1.24.0 or 2026.2.14.0 or higher immediately. Review and revoke any exposed API tokens. Audit user permissions to ensure no unauthorized access has occurred.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-17569. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart