Unrated severityNVD Advisory· Published Jul 27, 2026· Updated Jul 28, 2026

CVE-2026-17569

Description

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.

This issue affects :

Devolutions Server 2026.2.4.0 through 2026.2.12.0
Devolutions Server 2026.1.23.0 and earlier

Affected products

Devolutions/Devolutions Serverllm-fuzzy
Range: 2026.2.4.0 - 2026.2.12.0, 2026.1.23.0 and earlier

Patches

Vulnerability mechanics

References

devolutions.net/security/advisories/DEVO-2026-0026/mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000