This vulnerability (CVE-2026-17569) in Devolutions Server arises from insufficient protection of credentials (CWE-522) due to improper access control in the NetBox synchronizer. Authenticated users with view-only permissions can exploit the partial connection endpoint to obtain stored API tokens, which should normally be restricted. The affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier. The CVSS score is 4.3 (medium severity), indicating a network attack vector with low complexity and low impact on confidentiality only. No vendor advisory or patch information is currently available.

An authenticated user with limited (view-only) permissions can access stored API tokens that should be protected, potentially leading to credential exposure. This could allow the user to leverage these tokens for unauthorized actions depending on token privileges. The impact is limited to confidentiality loss; integrity and availability are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user permissions carefully and monitor access to sensitive API tokens. Avoid granting unnecessary view permissions on entries that contain sensitive credentials.