CVE-2026-17569
Severity CVSS v4.0:
Pending analysis
Type:
CWE-522
Insufficiently Protected Credentials
Publication date:
27/07/2026
Last modified:
27/07/2026
Description
Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.<br />
<br />
This issue affects :<br />
<br />
* Devolutions Server 2026.2.4.0 through 2026.2.12.0<br />
* Devolutions Server 2026.1.23.0 and earlier