{"id":"CVE-2026-110806","kind":"vulnerability","aliases":["CVE-2026-110806"],"related":[],"title":"Devolutions Server: view-only users can read add-on passwords","description":"Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.","summary":"Devolutions Server returns add-on properties unredacted in connection data, so a user with only View permission can read add-on passwords. The attacker needs a valid authenticated account with View rights.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"devolutions server","fixed":["2026.2.20.0"],"affected":"< 2026.2.20.0","ecosystem":"vendor"},{"name":"devolutions server","fixed":["2026.3.10.0"],"affected":">= 2026.3.5.0, < 2026.3.10.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["devolutions-server","self-hosted","vendor","windows"],"not_affected_if":["no-add-on-passwords","no-view-only-users"],"how_to_check":"- Confirm the installed Devolutions Server version in the admin console and compare it to `2026.2.20.0` and `2026.3.10.0`\n- Review which accounts hold only View permission and whether any add-ons store passwords","fix":"- Upgrade Devolutions Server to `2026.2.20.0` on the 2026.2 line, or to `2026.3.10.0` on the 2026.3 line\n- Rotate add-on passwords that may have been exposed to View-only users","status":"open","published_at":"2026-10-16T14:17:22+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:57:51+00:00","updated_at":"2026-10-25T03:57:51+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:57:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Devolutions Server to `2026.2.20.0` on the 2026.2 line, or to `2026.3.10.0` on the 2026.3 line\n- Rotate add-on passwords that may have been exposed to View-only users","reach":"network","title":"Devolutions Server: view-only users can read add-on passwords","impact":"medium","summary":"Devolutions Server returns add-on properties unredacted in connection data, so a user with only View permission can read add-on passwords. The attacker needs a valid authenticated account with View rights.","category":"vendor","nicknames":[],"who_cares":["devolutions-server","self-hosted","windows"],"confidence":0.7,"needs_auth":"yes","worst_case":"View-only user reads add-on passwords in connection data","analyst_note":"","how_to_check":"- Confirm the installed Devolutions Server version in the admin console and compare it to `2026.2.20.0` and `2026.3.10.0`\n- Review which accounts hold only View permission and whether any add-ons store passwords","needs_analyst":false,"not_affected_if":["no-view-only-users","no-add-on-passwords"],"who_is_affected":"Teams running self-hosted Devolutions Server at version 2026.3.8.0 or earlier, or affected builds from 2026.3.5.0 up to the fix, where add-ons hold passwords. Exposure needs an authenticated account with only View permission; installations without add-on passwords or with no View-only users have a smaller exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000614,"input_tokens":3381,"output_tokens":552,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110806':15A,18A '-2026':14A,17A '2026.3.8.0':75C 'account':61B 'add':10A,35B,52B,69C,89C,96C 'add-on':9A,34B,51B,68C,88C,95C 'allow':78C 'attack':56B 'authent':60B,80C 'author':66C 'connect':40B,101C 'cve':13A,16A 'data':41B,102C 'devolut':1A,24B,31B,73C 'devolutions':19A,21A 'devolutions-serv':23B 'earlier':77C 'host':28B 'incorrect':65C 'need':57B 'obtain':87C 'password':12A,54B,91C 'permiss':48B,85C 'properti':37B,71C,98C 'read':8A,50B 'return':33B,99C 'right':64B 'self':27B 'self-host':26B 'server':2A,20A,22A,25B,32B,74C 'unredact':38B,94C 'user':6A,44B,81C 'valid':59B 'vendor':29B 'via':92C 'view':4A,47B,63B,84C 'view-on':3A 'window':30B","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Devolutions Server at version 2026.3.8.0 or earlier, or affected builds from 2026.3.5.0 up to the fix, where add-ons hold passwords. Exposure needs an authenticated account with only View permission; installations without add-on passwords or with no View-only users have a smaller exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T14:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110806","severity":null,"published_at":"2026-10-16T14:17:22+00:00","modified_at":"2026-10-23T18:36:00+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}