---
id: "CVE-2026-114485"
kind: "vulnerability"
aliases: ["CVE-2026-114485"]
title: "Devolutions Server: user list API leaks every user's MFA secret"
severity: "medium"
cvss: null
epss: 0.0014
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["devolutions-server", "mfa", "other", "self-hosted"]
not_affected_if: ["no-delegated-user-view", "patched-version"]
published_at: "2026-10-22T16:17:34+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-25T05:00:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114485", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114485", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# Devolutions Server: user list API leaks every user's MFA secret

Devolutions Server 2026.3.10.0 and earlier include MFA secrets for all users in the user list API response. An authenticated attacker with delegated user-view permission can read those secrets and use them to generate valid MFA codes for other accounts.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Devolutions Server version against `2026.3.10.0` in the server admin console or the install folder.
- Review which accounts hold delegated user view permissions, since those are the accounts that can call the user list endpoint.

## Fix

- Upgrade Devolutions Server to a version later than `2026.3.10.0`; the exact fixed version is unknown from the sources.
- Until patched, limit delegated user view permissions to trusted accounts.
- Rotate MFA enrollments for users whose secrets may have been exposed, if the vendor advisory recommends it.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114485
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114485

## From the sources

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 
2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_