{"id":"CVE-2026-12117","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-12117","generatedAt":"2026-10-28T02:23:52.253Z","title":"Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.","description":"Improper access control in the social login connection endpoint in \nDevolutions Server 2026.2.5 allows an authenticated vault member to \nenumerate social login entry metadata to which they are not authorized \nvia a crafted API request.","published":"2026-06-16T20:16:28.000Z","lastModified":"2026-10-25T23:10:00.000Z","status":"Analyzed","sourceIdentifier":"security@devolutions.net","cvss":{"version":"3.1","score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"},"cwe":["CWE-200"],"affected":["devolutions/devolutions server"],"epss":{"score":0.00261,"percentile":0.17702,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0017/","tags":["Vendor Advisory"],"source":"security@devolutions.net"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-12117","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}