{"id":"CVE-2026-114485","kind":"vulnerability","aliases":["CVE-2026-114485"],"related":[],"title":"Devolutions Server: user list API leaks every user's MFA secret","description":"Insufficient protection of sensitive information in the user list endpoint in Devolutions Server \n2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.","summary":"Devolutions Server 2026.3.10.0 and earlier include MFA secrets for all users in the user list API response. An authenticated attacker with delegated user-view permission can read those secrets and use them to generate valid MFA codes for other accounts.","severity":"medium","cvss":null,"epss":0.0014,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devolutions-server","mfa","other","self-hosted"],"not_affected_if":["no-delegated-user-view","patched-version"],"how_to_check":"- Check the installed Devolutions Server version against `2026.3.10.0` in the server admin console or the install folder.\n- Review which accounts hold delegated user view permissions, since those are the accounts that can call the user list endpoint.","fix":"- Upgrade Devolutions Server to a version later than `2026.3.10.0`; the exact fixed version is unknown from the sources.\n- Until patched, limit delegated user view permissions to trusted accounts.\n- Rotate MFA enrollments for users whose secrets may have been exposed, if the vendor advisory recommends it.","status":"open","published_at":"2026-10-22T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-25T05:00:27+00:00","updated_at":"2026-10-25T05:00:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-10-25T05:00:27Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Devolutions Server to a version later than `2026.3.10.0`; the exact fixed version is unknown from the sources.\n- Until patched, limit delegated user view permissions to trusted accounts.\n- Rotate MFA enrollments for users whose secrets may have been exposed, if the vendor advisory recommends it.","reach":"network","title":"Devolutions Server: user list API leaks every user's MFA secret","impact":"high","summary":"Devolutions Server 2026.3.10.0 and earlier include MFA secrets for all users in the user list API response. An authenticated attacker with delegated user-view permission can read those secrets and use them to generate valid MFA codes for other accounts.","category":"other","nicknames":[],"who_cares":["devolutions-server","self-hosted","mfa"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker reads all users' MFA secrets and can generate their login codes.","analyst_note":"Confirm the fixed version and the vendor advisory for Devolutions Server; the NVD entry gave no product details beyond the description.","how_to_check":"- Check the installed Devolutions Server version against `2026.3.10.0` in the server admin console or the install folder.\n- Review which accounts hold delegated user view permissions, since those are the accounts that can call the user list endpoint.","needs_analyst":true,"not_affected_if":["patched-version","no-delegated-user-view"],"who_is_affected":"Teams running self-hosted Devolutions Server at version 2026.3.10.0 or earlier that have delegated user view permissions assigned to some accounts. Servers on newer versions, or with no delegated user-view roles, are not exposed by this flaw as described.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3337,"output_tokens":630,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114485':14A,17A '-2026':13A,16A '2026.3.10.0':28B,80C 'account':66B 'allow':83C 'api':5A,41B,104C 'attack':45B,86C 'authent':44B,85C 'code':63B 'cve':12A,15A 'deleg':47B,88C 'devolut':1A,19B,26B,78C 'devolutions-serv':18B 'earlier':30B,82C 'endpoint':76C 'everi':7A 'generat':60B 'host':25B 'includ':31B 'inform':71C 'insuffici':67C 'leak':6A 'list':4A,40B,75C,103C 'mfa':10A,21B,32B,62B,95C 'obtain':93C 'permiss':51B,91C 'protect':68C 'read':53B 'respons':42B,105C 'secret':11A,33B,55B,96C 'self':24B 'self-host':23B 'sensit':70C 'server':2A,20B,27B,79C 'use':57B 'user':3A,8A,36B,39B,49B,74C,89C,99C,102C 'user-view':48B 'valid':61B 'via':100C 'view':50B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted Devolutions Server at version 2026.3.10.0 or earlier that have delegated user view permissions assigned to some accounts. Servers on newer versions, or with no delegated user-view roles, are not exposed by this flaw as described.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114485","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114485","severity":null,"published_at":"2026-10-22T16:17:34+00:00","modified_at":"2026-10-22T16:54:17+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114485","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114485","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}