DEVOLUTIONS SERVER · CVE-2026-126332 · Package
FIX → 2026.3.14.0 +1 ✓ verified
Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its autofill vault search. A user with only view permission on a shared entry can read that entry's password in clear text through a linked credential entry in their private vault.
first public Nov 11, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Self-hosted Devolutions Server 2026.3.13.0 or earlier, and 2026.2.23.0 or earlier, where vault entries are shared with users who have view-only permission. Any authenticated user with view permission on a shared entry can create a linked credential entry in their private vault and read the shared entry's password in clear text through autofill vault search. Teams without shared entries or with only trusted full-access users have little exposure, and anyone on 2026.3.14.0 / 2026.2.24.0 or later can skip it.
Not affected if fixed-version, unknown
Who cares devolutions-server, password-manager, self-hosted
2026.3.13.0 or earlier (2026.3 branch) or 2026.2.23.0 or earlier (2026.2 branch)Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2026.3.14.0 +1
Upgrade Devolutions Server to 2026.3.14.0 or higher (2026.3 branch), or 2026.2.24.0 or higher (2026.2 branch).