PT-2026-121410

CVE-2026-114485

·

Published

2026-10-22

·

Updated

2026-10-22

Description by

Score
N/A
Not available

No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
Vendors
Affected products
Weakness enumeration
CWE-201: Insertion of Sensitive Information Into Sent Data
Related identifiers
CVE-2026-114485
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com