CVE-2026-12117

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

CVSS 3.1

4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.3% chance of exploitation in the next 30 days; higher than 17% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2026-06-16

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• devolutions:devolutions_server

References

• https://devolutions.net/security/advisories/DEVO-2026-0017/

Check your stackJSON