Devolutions Server CVE-2026-100286

Requires a valid authenticated but non-administrative Devolutions Server account (PR:L) with network access to the data source settings API; exploitation is a crafted API request against that specific endpoint, with no user interaction needed. The limiting factor is the authentication prerequisite - the attacker must already possess low-privilege credentials or be a malicious insider - which narrows this to post-authentication abuse rather than fully anonymous remote exploitation. Affected: Devolutions Server up to 2026.3.5.0 (fixed in 2026.3.7.0 per EUVD); no special non-default configuration is stated as required beyond having integration/data-source secrets configured to disclose.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent with the description: a network-reachable API flaw exploitable by an already-authenticated, low-privileged user with no user interaction, yielding high confidentiality impact (secret disclosure) but no integrity or availability effect. This is a plausible, correctly-scored MEDIUM issue rather than an inflated high-CVSS finding - the PR:L requirement (a valid non-admin account) meaningfully bounds real-world risk, since exploitation presumes an attacker has already obtained legitimate credentials or an insider is abusing access. No EPSS score, KEV listing, or public POC is present in the input, so exploitation status is 'no public exploit identified at time of analysis'; there is no SSVC decision block provided. A note on data: the CVE description states 'Devolutions Server 2026.3.5.0 and earlier' while the EUVD affected-version data indicates the flaw is fixed in 2026.3.7.0 (affected '<2026.3.7.0'), a minor discrepancy defenders should reconcile against the vendor advisory DEVO-2026-0034 when confirming their patch level. The core impact - disclosure of integration secrets (credentials to external data sources) - can enable lateral movement or privilege escalation into connected systems, so the downstream blast radius may exceed the base score's single-system confidentiality label.

A low-privileged authenticated user of Devolutions Server (or an attacker who has phished or otherwise obtained such an account) sends a crafted request to the data source settings API, which fails to enforce authorization, and reads integration secrets they should not be permitted to view. Those disclosed secrets - credentials for connected data sources/integrations - can then be reused to access external systems. No public exploit code is identified at time of analysis.