CVE-2026-3131

—

CVSS 3.1

6.5 medium

EPSS

<1%p23

Published

Feb 24, 2026 (Feb 24, 2026)

Modified

Jun 17, 2026

Description

Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.