CVE-2026-114485
Description
Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.
Is your site exposed to CVE-2026-114485?
Run a free security scan — no signup, results in seconds.
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Other References
Frequently Asked Questions
What is CVE-2026-114485? +
How do I check if I'm vulnerable to CVE-2026-114485? +
Related Vulnerabilities
An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, NO registration …
Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the …
An unauthenticated HTTP GET request to the /client.php endpoint will disclose the default administrator user credentials.
When the device is shared, the homepage module are before 2.19.0 in eWeLink Cloud Service allows Secondary user to take …
YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend …
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB …
