CVE-2026-6706

Published: Apr 28, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.

Affected (2)

Products: Devolutions: Devolutions Server

1 product

Devolutions Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	Before 2025.3.19.0
Devolutions Devolutions Server	From 2026.1.6.0 to 2026.1.15.0

Related CWEs

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0011

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.