CVE-2026-4927
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Apr 1, 2026
CISA due date
—
The record
Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-105777 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6.5 before… CWE-201
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-201
- CVE-2026-62088 Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress… CWE-201
- CVE-2026-81804 Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore Migration <= 2.4.2… CWE-201
- CVE-2026-78303 Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in… CWE-201
- CVE-2026-78374 Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page… CWE-201
- CVE-2026-86505 In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project… CWE-201
- CVE-2026-86497 In JetBrains YouTrack before 2026.2.18769 changing a mailbox host without… CWE-201