What is the CVSS score of CVE-2026-6706?

CVE-2026-6706 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-6706

EUVD-2026-26049 MEDIUM

Missing Authorization (CWE-862)

2026-04-28 DEVOLUTIONS

Hashicorp Authentication Bypass Server

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

API is network-accessible (AV:N), requires only a valid low-privilege account (PR:L), no scope change as impact stays within the server application, and only confidentiality is affected (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 04:25 vuln.today

CVSS changed

Apr 28, 2026 - 19:52 NVD

6.5 (MEDIUM)

EUVD ID Assigned

Apr 28, 2026 - 14:00 euvd

EUVD-2026-26049

CVE Published

Apr 28, 2026 - 13:11 nvd

MEDIUM 6.5

DescriptionCVE.org

Improper access control in the vault documentation feature in Devolutions Server 2026.1.14.0 and earlier allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request.

AnalysisAI

Authenticated attackers can read vault documentation from unauthorized vaults in Devolutions Server 2026.1.14.0 and earlier by sending a crafted API request that bypasses authorization checks on the vault documentation feature. The flaw stems from CWE-862 (Missing Authorization), where the server fails to verify that the requesting user has permission to access documentation tied to a specific vault. EPSS is 0.03% (8th percentile) and SSVC reports no known exploitation, indicating this is currently a theoretical risk with no observed active use.

Technical ContextAI

Devolutions Server is an enterprise privileged access management (PAM) platform that organizes credentials and sensitive assets into vaults, with role-based access controls governing which users can interact with each vault. The 'vault documentation' feature allows teams to attach notes or documentation to vaults. CWE-862 (Missing Authorization) indicates that the server-side API endpoint handling documentation retrieval fails to enforce a proper authorization check against the requesting user's vault permissions, allowing the access control boundary between vaults to be bypassed. The 'Hashicorp' tag in the intelligence data suggests the affected environment may involve HashiCorp Vault integration, potentially expanding the sensitivity of exposed documentation. The affected CPE is cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* covering all versions up to and including 2026.1.14.0.

RemediationAI

Upgrade Devolutions Server to the first release after 2026.1.14.0 that addresses this advisory, as directed by vendor advisory DEVO-2026-0011 at https://devolutions.net/security/advisories/DEVO-2026-0011. No specific patched version number is confirmed in the available data - consult the advisory directly to identify the exact remediated release before upgrading. As a compensating control pending upgrade, administrators should audit vault documentation content to ensure no high-sensitivity information (credentials, keys, network topology) is stored there, reducing the impact of unauthorized reads. Additionally, reviewing user account permissions to enforce the principle of least privilege limits which authenticated users can reach the affected API endpoint at all. Note that restricting API access at the network perimeter is not an effective compensating control since the flaw is authorization-layer, not network-layer.