CVE-2026-12117

—

CVSS 3.1

4.3 medium

EPSS

<1%p18

Published

Jun 16, 2026 (Jun 16, 2026)

Modified

Jun 18, 2026

Description

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.