CVE-2026-12117
published 2026-06-16CVE-2026-12117: Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login…
PriorityP430medium6.4
EPSS
0.18%
7.8th percentile
Improper access control in the social login connection endpoint in
Devolutions Server 2026.2.5 allows an authenticated vault member to
enumerate social login entry metadata to which they are not authorized
via a crafted API request.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devolutions | devolutions_server | >= 2026.2.0 < 2026.2.5 | 2026.2.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not aut
ghsa_unreviewed·2026-06-16
CVE-2026-12117 [MEDIUM] CWE-200 Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not aut
Improper access control in the social login connection endpoint in
Devolutions Server 2026.2.5 allows an authenticated vault member to
enumerate social login entry metadata to which they are not authorized
via a crafted API request.
VulDB
Devolutions Server up to 2026.2.4 Social Login Connection Endpoint information disclosure (DEVO-2026-0017 / EUVD-2026-37202)
vuldb·2026-06-16
CVE-2026-12117 [LOW] Devolutions Server up to 2026.2.4 Social Login Connection Endpoint information disclosure (DEVO-2026-0017 / EUVD-2026-37202)
A vulnerability labeled as problematic has been found in Devolutions Server up to 2026.2.4. This issue affects some unknown processing of the component Social Login Connection Endpoint. The manipulation results in information disclosure.
This vulnerability is known as CVE-2026-12117. It is possible to launch the attack remotely. No exploit is available.
The affected component should be upgraded.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-16
Published