---
id: "CVE-2026-126332"
page: "https://infrastack.ai/live/CVE-2026-126332"
kind: "vulnerability"
aliases: ["CVE-2026-126332"]
title: "Devolutions Server: autofill search leaks shared entry passwords to view-only users"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Devolutions Server", "fixed": ["2026.2.24.0", "2026.3.14.0"], "affected": "<= 2026.2.23.0, <= 2026.3.13.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["devolutions-server", "package", "password-manager", "self-hosted"]
not_affected_if: ["fixed-version", "unknown"]
published_at: "2026-11-11T22:17:27+00:00"
first_seen_at: "2026-11-11T22:29:34+00:00"
updated_at: "2026-11-11T22:47:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126332", "first_seen_at": "2026-11-11T22:29:34+00:00"}, {"source": "analyst", "url": "https://devolutions.net/security/advisories/DEVO-2026-0041/", "first_seen_at": "2026-11-11T22:35:30+00:00", "cites": ["https://devolutions.net/security/advisories/DEVO-2026-0041/"]}]
exploit_sources: []
---

# Devolutions Server: autofill search leaks shared entry passwords to view-only users

Link for people: https://infrastack.ai/live/CVE-2026-126332 (this .md is for agents)

Devolutions Server 2026.3.13.0 and earlier has an access control flaw in its autofill vault search. A user with only view permission on a shared entry can read that entry's password in clear text through a linked credential entry in their private vault.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Devolutions Server affected <= 2026.2.23.0, <= 2026.3.13.0 fixed 2026.2.24.0, 2026.3.14.0

## How to check

In the Devolutions Server admin console, check the installed version. You are affected if it is 2026.3.13.0 or earlier (2026.3 branch) or 2026.2.23.0 or earlier (2026.2 branch). The advisory names no setting that turns autofill search off, so there is nothing else to check.

## Fix

Upgrade Devolutions Server to 2026.3.14.0 or higher (2026.3 branch), or 2026.2.24.0 or higher (2026.2 branch).

## Timeline

- 2026-11-11T22:29:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126332
- 2026-11-11T22:35:30+00:00 analyst https://devolutions.net/security/advisories/DEVO-2026-0041/ — Vendor advisory DEVO-2026-0041 (Medium, CVSS 3.1 6.5, credit godsensei) gives affected and fixed versions. Lowered severity from high to the vendor's medium. No exploitation or PoC found. Advisory does not say whether autofill search is on by default, and it lists no workaround. I did not search social posts.

## Documents

- [advisory] Devolutions DEVO-2026-0041 https://devolutions.net/security/advisories/DEVO-2026-0041/

## From the sources

Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_