{"id":"CVE-2026-12117","state":"PUBLISHED","title":"Improper access control in the social login connection endpoint in ","description":"Improper access control in the social login connection endpoint in \nDevolutions Server 2026.2.5 allows an authenticated vault member to \nenumerate social login entry metadata to which they are not authorized \nvia a crafted API request.","publishedAt":"2026-06-16T18:25:19.018Z","updatedAt":"2026-06-17T15:14:46.588Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"CISA-ADP"},"assigner":"DEVOLUTIONS","products":["Devolutions Devolutions Server"],"affected":[{"vendor":"Devolutions","product":"Devolutions Server","defaultStatus":"unaffected","versions":[{"version":"2026.2.0","status":"affected","lessThan":"2026.2.5","versionType":"custom"}]}],"references":["https://devolutions.net/security/advisories/DEVO-2026-0017/"],"weaknesses":["CWE-200"],"ingestedAt":"2026-10-29T20:10:52.580Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/12xxx/CVE-2026-12117.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-12117","state":"PUBLISHED","datePublished":"2026-06-16T18:25:19.018Z","dateUpdated":"2026-06-17T15:14:46.588Z","assignerShortName":"DEVOLUTIONS","assignerOrgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateReserved":"2026-06-12T14:47:47.711Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper access control in the social login connection endpoint in \nDevolutions Server 2026.2.5 allows an authenticated vault member to \nenumerate social login entry metadata to which they are not authorized \nvia a crafted API request."}],"affected":[{"vendor":"Devolutions","product":"Devolutions Server","defaultStatus":"unaffected","versions":[{"version":"2026.2.0","status":"affected","lessThan":"2026.2.5","versionType":"custom"}]}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0017/"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","description":"CWE-200","type":"CWE"}]}],"providerMetadata":{"shortName":"DEVOLUTIONS","orgId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","dateUpdated":"2026-06-16T18:25:19.018Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 1.0.2"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":4.3,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"LOW","confidentialityImpact":"LOW"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-06-17T15:14:42.590567Z","id":"CVE-2026-12117","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-200","type":"CWE","lang":"en","description":"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-06-17T15:14:46.588Z"}}]}}}