{"id":"CVE-2026-126328","aliases":[],"cve":{"records":[{"id":"CVE-2026-126328","source":"DEVOLUTIONS","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-10T20:27:29.029Z","published":"2026-11-11T21:23:00.048Z","modified":"2026-11-11T21:23:00.048Z"}],"publishers":[{"name":"DEVOLUTIONS","role":"CNA","organizationId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","modified":"2026-11-11T21:23:00.048Z"}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0041/","tags":[],"source":"DEVOLUTIONS"}],"weaknesses":[{"id":"CWE-312","description":"CWE-312 Cleartext Storage of Sensitive Information","source":"DEVOLUTIONS"}],"applicability":[],"prioritization":[]},"title":"Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with…","titleSource":"DEVOLUTIONS","descriptionSource":"DEVOLUTIONS","description":"Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses.","score":null,"severity":"unknown","published":"2026-11-11T21:23:00.048Z","modified":"2026-11-11T21:23:00.048Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Devolutions","name":"Server","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2026.3.14","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"DEVOLUTIONS","url":"https://www.cve.org/CVERecord?id=CVE-2026-126328"}],"remediation":[],"references":["https://devolutions.net/security/advisories/DEVO-2026-0041/"],"sources":[{"name":"CVE","id":"CVE-2026-126328","modified":"2026-11-11T21:23:00.048Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-126328"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-11T22:15:49.885Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:00:33.317Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-12T02:20:30.997Z","attemptedAt":"2026-11-12T02:20:30.997Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-12T02:20:30.768Z","attemptedAt":"2026-11-12T02:20:30.768Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-12T02:20:30.771Z","attemptedAt":"2026-11-12T02:20:30.771Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-12T02:20:30.768Z","attemptedAt":"2026-11-12T02:20:30.768Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-jfr4-c54f-fr2v","url":"https://github.com/advisories/GHSA-jfr4-c54f-fr2v","modified":"2026-11-12T00:33:08Z","checkedAt":"2026-11-12T02:20:30.768Z"},{"source":"ENISA EUVD","id":"EUVD-2026-123813","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-123813","modified":"Nov 11, 2026, 9:23:00 PM","checkedAt":"2026-11-12T02:20:30.771Z"},{"source":"NVD","id":"CVE-2026-126328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126328","modified":"2026-11-11T22:17:27.060","checkedAt":"2026-11-12T02:20:30.997Z"}],"aiSummary":{"text":"Devolutions Server 2026.3.13.0 and earlier has a vulnerability that allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets. The weakness is due to the insertion of sensitive information into sent data in the user endpoints. This is a case of cleartext storage of sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-11T22:21:23.480Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-126328"}]}}