{"id":"CVE-2026-126331","kind":"vulnerability","aliases":["CVE-2026-126331"],"related":[],"title":"Devolutions Server: user list API leaks users' API key secret hashes","description":"Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.","summary":"Devolutions Server 2026.3.13.0 and earlier include users' API key secret hashes in the user list API response. An authenticated user with delegated user-viewing permission can read these hashes.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devolutions-server","other","self-hosted"],"not_affected_if":["auth-required","no-delegated-user-viewing"],"how_to_check":"- Check the installed Devolutions Server version against `2026.3.13.0`\n- Review which accounts hold delegated user-viewing permissions","fix":null,"status":"open","published_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:34:09+00:00","updated_at":"2026-11-11T22:34:09+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-11T22:34:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Devolutions Server: user list API leaks users' API key secret hashes","impact":"medium","summary":"Devolutions Server 2026.3.13.0 and earlier include users' API key secret hashes in the user list API response. An authenticated user with delegated user-viewing permission can read these hashes.","audience":"businesses","category":"other","nicknames":[],"who_cares":["devolutions-server","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated user reads other users' API key secret hashes","analyst_note":"Check the Devolutions advisory for the fixed version and whether the flaw needs delegated user-viewing permission to be enabled; the NVD entry gives neither.","how_to_check":"- Check the installed Devolutions Server version against `2026.3.13.0`\n- Review which accounts hold delegated user-viewing permissions","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["auth-required","no-delegated-user-viewing"],"who_is_affected":"Organizations running Devolutions Server 2026.3.13.0 or earlier where some users hold delegated permission to view other users. Exposure needs an authenticated account with that delegated permission. Sources do not say which later version fixes it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4534,"output_tokens":494,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-126331':14A,17A '-2026':13A,16A '2026.3.13.0':27B,70C 'allow':73C 'api':5A,8A,32B,40B,86C,94C 'authent':43B,75C 'cve':12A,15A 'data':61C 'deleg':46B,78C 'devolut':1A,19B,25B,68C 'devolutions-serv':18B 'earlier':29B,72C 'endpoint':66C 'hash':11A,35B,54B,89C 'host':24B 'includ':30B 'inform':58C 'insert':55C 'key':9A,33B,87C 'leak':6A 'list':4A,39B,65C,93C 'obtain':84C 'permiss':50B,82C 'read':52B 'respons':41B,95C 'secret':10A,34B,88C 'self':23B 'self-host':22B 'sensit':57C 'sent':60C 'server':2A,20B,26B,69C 'user':3A,7A,31B,38B,44B,48B,64C,76C,80C,85C,92C 'user-view':47B,79C 'via':90C 'view':49B,81C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Devolutions Server 2026.3.13.0 or earlier where some users hold delegated permission to view other users. Exposure needs an authenticated account with that delegated permission. Sources do not say which later version fixes it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devolutionsserver","medium","other","selfhosted"],"campaign_type":null,"search_a":"'-126331':14A,17A '-2026':13A,16A 'api':5A,8A 'cve':12A,15A 'devolut':1A 'hash':11A 'key':9A 'leak':6A 'list':4A 'secret':10A 'server':2A 'user':3A,7A","search_b":"'2026.3.13.0':27B 'api':32B,40B 'authent':43B 'deleg':46B 'devolut':19B,25B 'devolutions-serv':18B 'earlier':29B 'hash':35B,54B 'host':24B 'includ':30B 'key':33B 'list':39B 'permiss':50B 'read':52B 'respons':41B 'secret':34B 'self':23B 'self-host':22B 'server':20B,26B 'user':31B,38B,44B,48B 'user-view':47B 'view':49B","search_c":"'2026.3.13.0':70C 'allow':73C 'api':86C,94C 'authent':75C 'data':61C 'deleg':78C 'devolut':68C 'earlier':72C 'endpoint':66C 'hash':89C 'inform':58C 'insert':55C 'key':87C 'list':65C,93C 'obtain':84C 'permiss':82C 'respons':95C 'secret':88C 'sensit':57C 'sent':60C 'server':69C 'user':64C,76C,80C,85C,92C 'user-view':79C 'via':90C 'view':81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126331","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126331","severity":null,"published_at":"2026-11-11T22:17:27+00:00","modified_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}