CVE-2026-12117

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0017/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Control de acceso inadecuado en el endpoint de conexión de inicio de sesión social en Devolutions Server 2026.2.5 permite a un miembro autenticado de la bóveda enumerar metadatos de entradas de inicio de sesión social a los que no están autorizados a través de una solicitud API manipulada.

Information

Published : 2026-06-16 20:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-12117

Mitre link : CVE-2026-12117

CVE.ORG link : CVE-2026-12117

JSON object : View

Products Affected

devolutions

devolutions_server

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-12117", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-12117", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T15:14:42.590567Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "Devolutions Server", "versions": [{"status": "affected", "version": "2026.2.0", "lessThan": "2026.2.5", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-16T20:16:27.577", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0017/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-200"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Improper access control in the social login connection endpoint in \nDevolutions Server 2026.2.5 allows an authenticated vault member to \nenumerate social login entry metadata to which they are not authorized \nvia a crafted API request."}, {"lang": "es", "value": "Control de acceso inadecuado en el endpoint de conexi\u00f3n de inicio de sesi\u00f3n social en Devolutions Server 2026.2.5 permite a un miembro autenticado de la b\u00f3veda enumerar metadatos de entradas de inicio de sesi\u00f3n social a los que no est\u00e1n autorizados a trav\u00e9s de una solicitud API manipulada."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "78E3C256-48A1-4201-8CAF-1C2CEBA5AD44", "versionEndExcluding": "2026.2.7.0", "versionStartIncluding": "2026.2.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}