{"id":"CVE-2026-120734","kind":"vulnerability","aliases":["CVE-2026-120734"],"related":[],"title":"Devolutions Server: email test leaks stored SMTP password to attacker host","description":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.","summary":"The email configuration test in Devolutions Server 2026.3.13.0 and earlier sends the stored SMTP password in cleartext when the request names an attacker-controlled SMTP host. An authenticated user with access to the test action can collect that password.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devolutions-server","other","self-hosted","smtp"],"not_affected_if":["no-smtp-configured","no-untrusted-users"],"how_to_check":"- Check the installed Devolutions Server version against the affected range `2026.3.13.0` and earlier.\n- Confirm which accounts can reach the email configuration test action in the admin settings.","fix":null,"status":"open","published_at":"2026-11-03T21:17:04+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","triaged_at":"2026-11-03T21:27:39+00:00","updated_at":"2026-11-03T21:27:39+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-03T21:27:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Devolutions Server: email test leaks stored SMTP password to attacker host","impact":"medium","summary":"The email configuration test in Devolutions Server 2026.3.13.0 and earlier sends the stored SMTP password in cleartext when the request names an attacker-controlled SMTP host. An authenticated user with access to the test action can collect that password.","audience":"businesses","category":"other","nicknames":[],"who_cares":["devolutions-server","smtp","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"SMTP password readable by an authenticated user, enabling mail account takeover","analyst_note":"Confirm the fixed version and any vendor advisory for Devolutions Server; the NVD entry gives no fix or check details.","how_to_check":"- Check the installed Devolutions Server version against the affected range `2026.3.13.0` and earlier.\n- Confirm which accounts can reach the email configuration test action in the admin settings.","plain_action":"","needs_analyst":true,"not_affected_if":["no-smtp-configured","no-untrusted-users"],"who_is_affected":"Teams running Devolutions Server 2026.3.13.0 or earlier with an email (SMTP) notification setup. Exposure requires an authenticated user who can reach the email configuration test action; instances without SMTP configured or without such users are unlikely to be exposed. unknown whether the sources list other conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000687,"input_tokens":4107,"output_tokens":553,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120734':14A,17A '-2026':13A,16A '2026.3.13.0':33B,79C 'access':57B,87C 'action':61B,91C 'allow':82C 'attack':10A,49B,105C 'attacker-control':48B,104C 'authent':54B,84C 'cleartext':42B,66C 'collect':63B 'configur':28B,74C 'control':50B,106C 'cve':12A,15A 'devolut':1A,19B,31B,77C 'devolutions-serv':18B 'earlier':35B,81C 'email':3A,27B,73C 'host':11A,24B,52B,108C 'inform':70C 'leak':5A 'name':46B,102C 'obtain':93C 'password':8A,40B,65B,97C 'request':45B,100C 'self':23B 'self-host':22B 'send':36B 'sensit':69C 'server':2A,20B,32B,78C 'smtp':7A,25B,39B,51B,96C,107C 'store':6A,38B,95C 'test':4A,29B,60B,75C,90C 'transmiss':67C 'user':55B,85C 'via':98C","nicknames":[],"mitigations":[],"who_affected":"Teams running Devolutions Server 2026.3.13.0 or earlier with an email (SMTP) notification setup. Exposure requires an authenticated user who can reach the email configuration test action; instances without SMTP configured or without such users are unlikely to be exposed. unknown whether the sources list other conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devolutionsserver","medium","other","selfhosted","smtp"],"campaign_type":null,"first_public_at":"2026-11-03T21:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120734","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120734","severity":null,"published_at":"2026-11-03T21:17:04+00:00","modified_at":"2026-11-03T21:17:04+00:00","first_seen_at":"2026-11-03T21:19:08+00:00","fetched_at":"2026-11-03T21:19:08+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}