CVE-2026-114485 — MEDIUM (4.3)

Vulnerability Description

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-201

References

https://devolutions.net/security/advisories/DEVO-2026-0037/

FAQ

What is CVE-2026-114485?

CVE-2026-114485 is a vulnerability with a CVSS score of 4.3 (MEDIUM). Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtai...

How severe is CVE-2026-114485?

CVE-2026-114485 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-114485?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.