{"id":"CVE-2026-126332","kind":"vulnerability","aliases":["CVE-2026-126332"],"related":[],"title":"Devolutions Server: autofill search leaks shared entry passwords to view-only users","description":"Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.","summary":"Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its autofill vault search. A user with only view permission on a shared entry can read that entry's password in clear text through a linked credential entry in their private vault.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Devolutions Server","fixed":["2026.2.24.0","2026.3.14.0"],"affected":"<= 2026.2.23.0, <= 2026.3.13.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["devolutions-server","package","password-manager","self-hosted"],"not_affected_if":["fixed-version","unknown"],"how_to_check":"In the Devolutions Server admin console, check the installed version. You are affected if it is 2026.3.13.0 or earlier (2026.3 branch) or 2026.2.23.0 or earlier (2026.2 branch). The advisory names no setting that turns autofill search off, so there is nothing else to check.","fix":"Upgrade Devolutions Server to 2026.3.14.0 or higher (2026.3 branch), or 2026.2.24.0 or higher (2026.2 branch).","status":"open","published_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:34:08+00:00","updated_at":"2026-11-11T22:47:50+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-11T22:34:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Devolutions Server: autofill search leaks shared entry passwords to view-only users","impact":"medium","summary":"Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its autofill vault search. A user with only view permission on a shared entry can read that entry's password in clear text through a linked credential entry in their private vault.","audience":"businesses","category":"package","nicknames":[],"who_cares":["devolutions-server","password-manager"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated view-only user reads shared entry passwords in clear text","analyst_note":"Check the Devolutions advisory for the fixed version and whether autofill search is enabled by default.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running Devolutions Server 2026.3.13.0 or earlier where users share vault entries with view-only permission. Exposure depends on the autofill vault search and on users linking credential entries in private vaults; the sources do not say more.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000671,"input_tokens":4526,"output_tokens":436,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the Devolutions advisory for the fixed version and whether autofill search is enabled by default.","search":"'-126332':16A,19A '-2026':15A,18A '2026.3.13.0':34B,86C 'access':39B,76C 'allow':89C 'authent':91C 'autofil':3A,44B,80C 'clear':64B,106C 'control':40B,77C 'creat':113C 'credenti':69B,111C 'cve':14A,17A 'devolut':1A,23B,32B,84C 'devolutions':20A 'devolutions-serv':22B 'earlier':36B,88C 'entri':7A,56B,60B,70B,100C,112C 'flaw':41B 'host':31B 'improp':75C 'leak':5A 'link':68B,110C 'manag':28B 'obtain':102C 'packag':25B 'password':8A,27B,62B,104C 'password-manag':26B 'permiss':52B,96C 'privat':73B,116C 'read':58B 'search':4A,46B,82C 'self':30B 'self-host':29B 'server':2A,21A,24B,33B,85C 'share':6A,55B,99C 'text':65B,107C 'user':13A,48B,92C 'vault':45B,74B,81C,117C 'via':108C 'view':11A,51B,95C 'view-on':10A","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Devolutions Server 2026.3.13.0 or earlier, and 2026.2.23.0 or earlier, where vault entries are shared with users who have view-only permission. Any authenticated user with view permission on a shared entry can create a linked credential entry in their private vault and read the shared entry's password in clear text through autofill vault search. Teams without shared entries or with only trusted full-access users have little exposure, and anyone on 2026.3.14.0 / 2026.2.24.0 or later can skip it.","tier":"C","verified":{"fix":{"at":"2026-11-11T22:35:30Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3614},"products":{"at":"2026-11-11T22:35:30Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3614},"how_to_check":{"at":"2026-11-11T22:35:30Z","by":"analyst","doc":"https://devolutions.net/security/advisories/DEVO-2026-0041/","run_id":3614}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["devolutionsserver","server"],"ptokens":["devolutions","server"],"labels":["devolutionsserver","medium","package","passwordmanager","selfhosted"],"campaign_type":null,"search_a":"'-126332':16A,19A '-2026':15A,18A 'autofil':3A 'cve':14A,17A 'devolut':1A 'devolutions':20A 'entri':7A 'leak':5A 'password':8A 'search':4A 'server':2A,21A 'share':6A 'user':13A 'view':11A 'view-on':10A","search_b":"'2026.3.13.0':34B 'access':39B 'autofil':44B 'clear':64B 'control':40B 'credenti':69B 'devolut':23B,32B 'devolutions-serv':22B 'earlier':36B 'entri':56B,60B,70B 'flaw':41B 'host':31B 'link':68B 'manag':28B 'packag':25B 'password':27B,62B 'password-manag':26B 'permiss':52B 'privat':73B 'read':58B 'search':46B 'self':30B 'self-host':29B 'server':24B,33B 'share':55B 'text':65B 'user':48B 'vault':45B,74B 'view':51B","search_c":"'2026.3.13.0':86C 'access':76C 'allow':89C 'authent':91C 'autofil':80C 'clear':106C 'control':77C 'creat':113C 'credenti':111C 'devolut':84C 'earlier':88C 'entri':100C,112C 'improp':75C 'link':110C 'obtain':102C 'password':104C 'permiss':96C 'privat':116C 'search':82C 'server':85C 'share':99C 'text':107C 'user':92C 'vault':81C,117C 'via':108C 'view':95C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T22:17:27+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126332","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126332","severity":null,"published_at":"2026-11-11T22:17:27+00:00","modified_at":"2026-11-11T22:17:27+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-126332:3614","url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","severity":null,"published_at":"2026-11-11T22:35:30+00:00","modified_at":"2026-11-11T22:35:30+00:00","first_seen_at":"2026-11-11T22:35:30+00:00","fetched_at":"2026-11-11T22:35:30+00:00","note":"Vendor advisory DEVO-2026-0041 (Medium, CVSS 3.1 6.5, credit godsensei) gives affected and fixed versions. Lowered severity from high to the vendor's medium. No exploitation or PoC found. Advisory does not say whether autofill search is on by default, and it lists no workaround. I did not search social posts.","cites":["https://devolutions.net/security/advisories/DEVO-2026-0041/"]}],"documents":[{"id":129656,"url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","title":"Devolutions DEVO-2026-0041","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}