{"id":"CVE-2026-126328","kind":"vulnerability","aliases":["CVE-2026-126328"],"related":[],"title":"Devolutions Server: user API leaks users' MFA shared secrets to delegated viewers","description":"Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.","summary":"Devolutions Server 2026.3.13.0 and earlier include users' MFA shared secrets in user API responses. An authenticated user with delegated user-viewing permissions can read those secrets and could use them to generate the victims' one-time codes.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Devolutions Server","fixed":["2026.3.14.0","2026.2.24.0"],"affected":"<= 2026.3.13.0; <= 2026.2.23.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","devolutions-server","mfa","other","self-hosted"],"not_affected_if":["auth-required","no-delegated-user-viewing"],"how_to_check":"Check the Devolutions Server version in the admin console. Exposed if it is 2026.3.13.0 or earlier (2026.3 branch) or 2026.2.23.0 or earlier (2026.2 branch). Also list which accounts hold delegated user-viewing permissions; those accounts could read other users' MFA shared secrets.","fix":"Upgrade Devolutions Server to 2026.3.14.0 or later (2026.3 branch), or 2026.2.24.0 or later (2026.2 branch). Vendor lists no workaround. Afterwards consider rotating MFA secrets of users visible to delegated viewers.","status":"open","published_at":"2026-11-11T22:17:26+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:34:09+00:00","updated_at":"2026-11-11T22:47:50+00:00","category":"other","confidence":0.85,"triage":{"at":"2026-11-11T22:34:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Devolutions Server: user API leaks users' MFA shared secrets to delegated viewers","impact":"high","summary":"Devolutions Server 2026.3.13.0 and earlier include users' MFA shared secrets in user API responses. An authenticated user with delegated user-viewing permissions can read those secrets and could use them to generate the victims' one-time codes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["devolutions-server","self-hosted","mfa"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"MFA secrets of other users readable, enabling account takeover","analyst_note":"Confirm the fixed version and any setting from the Devolutions advisory; NVD text alone gives no fix.","how_to_check":"- Check the installed Devolutions Server version against `2026.3.13.0`\n- unknown for other checks: the sources do not say","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-delegated-user-viewing"],"who_is_affected":"Organizations running Devolutions Server 2026.3.13.0 or earlier where some users hold delegated permissions to view other users. Installations without delegated user-viewing roles are not described as exposed. The sources do not say which other configurations apply.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4533,"output_tokens":497,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and any setting from the Devolutions advisory; NVD text alone gives no fix.","search":"'-126328':15A,18A '-2026':14A,17A '2026.3.13.0':34B,85C 'allow':88C 'api':4A,44B,107C 'auth':22B 'auth-requir':21B 'authent':47B,90C 'code':70B 'could':60B 'cve':13A,16A 'data':77C 'deleg':11A,50B,93C 'devolut':1A,25B,32B,83C 'devolutions':19A 'devolutions-serv':24B 'earlier':36B,87C 'endpoint':81C 'generat':64B 'host':31B 'includ':37B 'inform':74C 'insert':71C 'leak':5A 'mfa':7A,27B,39B,101C 'obtain':99C 'one':68B 'one-tim':67B 'permiss':54B,97C 'read':56B 'requir':23B 'respons':45B,108C 'secret':9A,41B,58B,103C 'self':30B 'self-host':29B 'sensit':73C 'sent':76C 'server':2A,20A,26B,33B,84C 'share':8A,40B,102C 'time':69B 'use':61B 'user':3A,6A,38B,43B,48B,52B,80C,91C,95C,100C,106C 'user-view':51B,94C 'via':104C 'victim':66B 'view':53B,96C 'viewer':12A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Devolutions Server 2026.3.13.0 and earlier, or 2026.2.23.0 and earlier, is affected. The user API responses include users' MFA shared secrets, so any authenticated user with delegated user-viewing permissions can read them and could generate those users' one-time codes. Teams that give nobody delegated user-viewing rights have less exposure, but should still upgrade.","tier":"C","verified":{"fix":{"at":"2026-11-11T22:35:49Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3615},"products":{"at":"2026-11-11T22:35:49Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3615},"how_to_check":{"at":"2026-11-11T22:35:49Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3615},"who_affected":{"at":"2026-11-11T22:35:49Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3615}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["devolutionsserver","server"],"ptokens":["devolutions","server"],"labels":["authrequired","devolutionsserver","medium","mfa","other","selfhosted"],"campaign_type":null,"search_a":"'-126328':15A,18A '-2026':14A,17A 'api':4A 'cve':13A,16A 'deleg':11A 'devolut':1A 'devolutions':19A 'leak':5A 'mfa':7A 'secret':9A 'server':2A,20A 'share':8A 'user':3A,6A 'viewer':12A","search_b":"'2026.3.13.0':34B 'api':44B 'auth':22B 'auth-requir':21B 'authent':47B 'code':70B 'could':60B 'deleg':50B 'devolut':25B,32B 'devolutions-serv':24B 'earlier':36B 'generat':64B 'host':31B 'includ':37B 'mfa':27B,39B 'one':68B 'one-tim':67B 'permiss':54B 'read':56B 'requir':23B 'respons':45B 'secret':41B,58B 'self':30B 'self-host':29B 'server':26B,33B 'share':40B 'time':69B 'use':61B 'user':38B,43B,48B,52B 'user-view':51B 'victim':66B 'view':53B","search_c":"'2026.3.13.0':85C 'allow':88C 'api':107C 'authent':90C 'data':77C 'deleg':93C 'devolut':83C 'earlier':87C 'endpoint':81C 'inform':74C 'insert':71C 'mfa':101C 'obtain':99C 'permiss':97C 'respons':108C 'secret':103C 'sensit':73C 'sent':76C 'server':84C 'share':102C 'user':80C,91C,95C,100C,106C 'user-view':94C 'via':104C 'view':96C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126328","severity":null,"published_at":"2026-11-11T22:17:26+00:00","modified_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126328:3615","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","severity":null,"published_at":"2026-11-11T22:35:49+00:00","modified_at":"2026-11-11T22:35:49+00:00","first_seen_at":"2026-11-11T22:35:49+00:00","fetched_at":"2026-11-11T22:35:49+00:00","note":"Read Devolutions DEVO-2026-0041 (primary): fixed in 2026.3.14.0 / 2026.2.24.0; no workaround listed. Not exploited, no PoC seen; no social search done.","cites":["https://devolutions.net/security/advisories/DEVO-2026-0041/"]}],"documents":[{"id":129656,"url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","title":"Devolutions DEVO-2026-0041","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}