CVE-2026-12117: Devolutions Server Access Control Flaw Enables Social Login Metadata Enumeration

Technical summary

CVE-2026-12117 stems from improper access control validation on the social login connection endpoint in Devolutions Server 2026.2.5. The vulnerability enables an authenticated vault member to bypass authorization checks and retrieve social login entry metadata via crafted API requests. The flaw is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), confirming that the core issue is insufficient boundary enforcement between user roles and sensitive configuration data. The CVSS 3.1 score of 4.3 reflects the requirement for prior authentication, the network-accessible endpoint, and the confidentiality impact limited to metadata disclosure without integrity or availability compromise.

Business impact

Exposure of social login metadata could enable reconnaissance by internal actors or attackers with compromised credentials. Social login configurations often include details about third-party identity providers, redirect URIs, and integration scope—information that could support lateral movement or social engineering targeting integrated applications. For organizations using Devolutions Server as a centralized credential vault, this represents a control boundary violation that undermines the principle of least privilege in secret management. The risk is moderate because exploitation requires existing authentication and the damage is primarily informational, but metadata disclosure can significantly lower the bar for subsequent attacks.

Affected systems

The vulnerability specifically affects Devolutions Server version 2026.2.5. Organizations running this version with social login connections configured and multiple vault members with different privilege levels face the highest risk. The flaw does not appear to affect other Devolutions products based on available data, though administrators should verify their specific deployment versions against vendor advisories.

Exploitability

Exploitation requires an authenticated account within the Devolutions vault, meaning external unauthenticated attackers cannot directly trigger the flaw. However, the bar for exploitation is low once credentials are obtained: the attacker simply crafts API requests to the social login endpoint without requiring user interaction or special tools. The attack surface is internal but real—any vault member, regardless of intended privilege level, can attempt enumeration. The vulnerability is not currently tracked in the CISA Known Exploited Vulnerabilities catalog, though this does not indicate absence of threat actor interest given the simplicity of exploitation.

Remediation

Patch to a version of Devolutions Server that addresses this access control flaw. Consult the vendor advisory for the specific patched version number and upgrade timeline. In the interim, implement network segmentation to restrict API access to the social login endpoint, enforce strong authentication policies to reduce compromised credential risk, and audit vault membership to ensure role assignments align with business need. Monitor API logs for unusual enumeration patterns against social login endpoints as a detective control.

Patch guidance

Apply patches from Devolutions as soon as they are available and validated in your test environment. Given the MEDIUM severity and the requirement for prior authentication, this should be prioritized within a standard maintenance cycle but does not warrant emergency patching. Verify the patched version number in the official Devolutions advisory before deployment. Test social login functionality after patching to ensure integration with connected identity providers remains operational.

Detection guidance

Monitor Devolutions Server API logs for repeated requests to social login connection endpoints originating from vault members who should not have authorization to those resources. Look for patterns of enumeration—multiple sequential requests with different parameters—from authenticated sessions. SIEM rules should flag unusual API activity against sensitive endpoints, particularly where role-based access control boundaries may be tested. Periodic access reviews of vault member roles against their actual API usage patterns can reveal misaligned permissions before exploitation occurs.

Why prioritize this

CVE-2026-12117 merits prioritization within a standard patching cadence due to its low barrier to exploitation (authenticated attacker, simple API request) and its violation of fundamental access control principles. While the MEDIUM CVSS reflects limited direct impact, metadata disclosure in a credential management platform can amplify downstream risks. Organizations should patch ahead of any public tooling that might automate exploitation, though the lack of KEV designation suggests current threat activity is not widespread. Prioritize instances where vault members span multiple organizational units or trust boundaries.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects a network-accessible, low-complexity attack that requires low privilege (PR:L) and valid vault authentication. The vulnerability causes confidentiality impact (C:L)—unauthorized access to social login metadata—but does not compromise integrity or availability (I:N/A:N). The attack scope remains unchanged (S:U), meaning the attacker cannot pivot to systems outside Devolutions Server itself. While the score is moderate, organizations should weigh the strategic value of social login configuration data in their threat model; for some enterprises, metadata disclosure warrants more urgent attention than the base score alone suggests.

Frequently asked questions