CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0025/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Inserción de información sensible en los datos enviados en la API de trabajos de automatización en Devolutions PowerShell Universal 2026.2.2 y versiones anteriores permite a un usuario autenticado con permiso de lectura de trabajos o scripts con ámbito obtener el token de actualización OAuth almacenado de otro usuario a través de las respuestas de lectura de trabajos que no eliminan el token de actualización.

Information

Published : 2026-07-24 15:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-16798

Mitre link : CVE-2026-16798

CVE.ORG link : CVE-2026-16798

JSON object : View

Products Affected

devolutions

powershell_universal

CWE

CWE-201

Insertion of Sensitive Information Into Sent Data

{"id": "CVE-2026-16798", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16798", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-24T17:49:06.755080Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "PowerShell Universal", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-24T15:17:12.750", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0025/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-201"}]}], "descriptions": [{"lang": "en", "value": "Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token."}, {"lang": "es", "value": "Inserci\u00f3n de informaci\u00f3n sensible en los datos enviados en la API de trabajos de automatizaci\u00f3n en Devolutions PowerShell Universal 2026.2.2 y versiones anteriores permite a un usuario autenticado con permiso de lectura de trabajos o scripts con \u00e1mbito obtener el token de actualizaci\u00f3n OAuth almacenado de otro usuario a trav\u00e9s de las respuestas de lectura de trabajos que no eliminan el token de actualizaci\u00f3n."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "901C92C3-006F-4833-8D7E-DFE0B8A9E60E", "versionEndExcluding": "2026.2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}