medium6.5
CVE-2026-110806
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-…
Impact
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Devolutions | Devolutions Server | before 2026.2.20.0 from 2026.3.5.0 before 2026.3.10.0 |