What is the CVSS score of CVE-2026-12117?

CVE-2026-12117 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-12117?

Yes, a patch is available for CVE-2026-12117. Update the affected software to the latest version immediately.

Devolutions Server CVE-2026-12117

EUVD-2026-37202 MEDIUM

Information Exposure (CWE-200)

2026-06-16 DEVOLUTIONS

GHSA-j57w-8xwx-5rfg

Information Disclosure Hashicorp Devolutions Server Devolutions

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Requires valid vault member authentication (PR:L) over network; impact is metadata enumeration only, so C:L with no integrity or availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 16:37 vuln.today

Patch available

Jun 16, 2026 - 21:02 EUVD

CVE Published

Jun 16, 2026 - 18:25 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

AnalysisAI

Improper access control in Devolutions Server 2026.2.x exposes social login entry metadata to authenticated vault members who lack authorization to view it. By sending crafted API requests to the social login connection endpoint, a low-privileged vault member can enumerate metadata - such as identity provider configurations and connection identifiers - belonging to vaults or entries outside their permitted scope. No active exploitation has been identified (SSVC: none, EPSS: 0.14%), and the vendor-released patch in version 2026.2.5 is available; risk is most meaningful in multi-tenant or strictly segmented vault deployments.

Technical ContextAI

Devolutions Server is a commercial privileged access management (PAM) and password vault platform. The affected component is the social login connection endpoint, which manages OAuth and social identity provider integrations within the vault. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) identifies the root cause as insufficient server-side authorization enforcement: the API endpoint returns social login entry metadata without validating whether the requesting user holds appropriate permissions for the referenced entries. The CPE identifier cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:* with the EUVD-confirmed affected range of 2026.2.0 through pre-2026.2.5 scopes the issue to a recent minor version series. The 'Hashicorp' tag in the intelligence data likely reflects a related secrets-management integration context rather than indicating HashiCorp Vault as a co-affected product.

RemediationAI

Upgrade to Devolutions Server 2026.2.5 or later, which resolves the access control flaw per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0017/. If immediate patching is not feasible, restrict network-layer access to the social login connection API endpoint using a reverse proxy or firewall rule to limit which authenticated users or source IP ranges can reach it - note this may disrupt legitimate social login workflows for affected users. Additionally, audit and tighten vault member role assignments to enforce least-privilege access, reducing the enumerable attack surface. These compensating controls do not eliminate the underlying flaw and should be treated as temporary measures until the patch is applied.