CVE-2026-120716

Full vulnerability record from the local CVENow database.

Description

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

Severity

Not scored

CVSS score

Not available

Vulnerability status

Awaiting Analysis

Source identifier

[email protected]

Published

2026-11-03 21:17:04.413000

Last modified

2026-11-03 21:17:04.510000

View original CVE JSON

{
  "id": "CVE-2026-120716",
  "sourceIdentifier": "[email protected]",
  "published": "2026-11-03T21:17:04.413",
  "lastModified": "2026-11-03T21:17:04.510",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Devolutions",
          "product": "Server",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "2026.3.13.0",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {},
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-201"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://devolutions.net/security/advisories/DEVO-2026-0039/",
      "source": "[email protected]"
    }
  ]
}