Live › vulnerability › CVE-2026-110806
Go to dashboardDevolutions Server returns add-on properties unredacted in connection data, so a user with only View permission can read add-on passwords. The attacker needs a valid authenticated account with View rights.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Devolutions Server at version 2026.3.8.0 or earlier, or affected builds from 2026.3.5.0 up to the fix, where add-ons hold passwords. Exposure needs an authenticated account with only View permission; installations without add-on passwords or with no View-only users have a smaller exposure.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| devolutions server | vendor | < 2026.2.20.0 | 2026.2.20.0 |
| devolutions server | vendor | >= 2026.3.5.0, < 2026.3.10.0 | 2026.3.10.0 |
2026.2.20.0 and 2026.3.10.02026.2.20.0 on the 2026.2 line, or to 2026.3.10.0 on the 2026.3 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
This page as .md · .json · in your agent: get_signal("CVE-2026-110806")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.