CVE-2026-120716
NoneCVSS
—
EPSS
0.1%
Published
Nov 3, 2026
CISA due date
—
The record
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-115293 Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability… CWE-201
- CVE-2026-114183 Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere… CWE-201
- CVE-2026-121554 cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure… CWE-201
- CVE-2026-88811 Missing filtering in the SUSE Rancher Manager meta proxy could cause passed in rancher… CWE-201
- CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. CWE-201
- CVE-2026-115947 Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. CWE-201
- CVE-2026-119564 Plausible Analytics Community Edition through 3.2.1 contains an information exposure… CWE-201
- CVE-2026-107268 Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor… CWE-201