Insufficient protection of sensitive information in the user list endpoint in Devolutions Server
2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
CVE-2026-114485
NONE
EPSS 0.14%
Updated Oct 22, 2026
Insufficient
CVE Details
CVE ID
CVE-2026-114485
Published Date
Oct 22, 2026
Vendor
Insufficient
Severity
NONE
Exploit Prediction (EPSS)
Probability of Exploit
0.14%
Likelihood of exploitation in next 30 days
Percentile:
3.0th percentile (higher than 3.0% of all CVEs)
Standard patching cycle
Impact
Minimal impact
Source
View Advisory