CVE-2026-12117

EUVD-2026-37202
Improper access control in the social login connection endpoint in 
Devolutions Server 2026.2.5 allows an authenticated vault member to 
enumerate social login entry metadata to which they are not authorized 
via a crafted API request.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 17%
Affected Products (NVD)
VendorProductVersion
devolutionsdevolutions_server
2026.2.4.0 ≤
𝑥
< 2026.2.7.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://devolutions.net/security/advisories/DEVO-2026-0017/