Devolutions Server EUVD-2026-102875

Requires an authenticated Devolutions Server account holding at least View permission on connections whose configuration includes add-ons containing stored passwords; requesting that connection's data returns the add-on properties unredacted. Exploitation is limited to existing authenticated users (no anonymous/unauthenticated path) and only yields secrets for connections the user can already view, and only applies to versions 2026.3.8.0 and earlier (fixed in 2026.3.10). No user interaction by a victim is needed, but the attacker must already possess valid low-privilege credentials.

This is a genuine but moderate-priority information-disclosure issue, not a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5 Medium) indicates a network-reachable, low-complexity flaw that nonetheless REQUIRES an authenticated account (PR:L), bounding the attacker population to existing low-privilege users. All corroborating signals point the same low-urgency direction: CISA SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, and no EPSS score, KEV listing, or public POC was provided in the input (so: no public exploit identified at time of analysis). The only elevated metric is confidentiality (C:H), reflecting that the leaked data is sensitive credentials (add-on passwords). There is no conflict between signals - CVSS, SSVC, and the description all agree this is an authenticated insider-access authorization flaw rather than a remotely-automatable mass-exploitation threat. Note the input 'Authentication Bypass' tag conflicts with the actual nature of the bug (CWE-863 Incorrect Authorization, exploited BY an authenticated user), which should not be read as an unauthenticated bypass.

A legitimate low-privilege Devolutions Server user who has been granted only View permission on a connection requests that connection's data through the normal API/UI and receives the add-on properties with passwords returned in cleartext rather than redacted. The user thereby harvests credentials they were never authorized to see, enabling lateral movement using those recovered secrets. No public exploit code is identified, and exploitation requires low complexity (AC:L) but a pre-existing authenticated account (PR:L).