Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.
This issue affects :
* Devolutions Server 2026.2.4.0
* Devolutions Server 2026.1.20.0 and earlier
References
| Link | Resource |
|---|---|
| https://devolutions.net/security/advisories/DEVO-2026-0015/ | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
12 Jun 2026, 17:56
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://devolutions.net/security/advisories/DEVO-2026-0015/ - Vendor Advisory | |
| CPE | cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:* cpe:2.3:a:devolutions:devolutions_server:2026.2.4.0:*:*:*:*:*:*:* |
|
| First Time |
Devolutions
Devolutions devolutions Server |
08 Jun 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
08 Jun 2026, 19:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-08 19:16
Updated : 2026-06-12 17:56
NVD link : CVE-2026-10786
Mitre link : CVE-2026-10786
CVE.ORG link : CVE-2026-10786
JSON object : View
Products Affected
devolutions
- devolutions_server
CWE
CWE-312
Cleartext Storage of Sensitive Information