Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the… (CVE-2026-90969)
An improper access control vulnerability exists in the vault entry listing feature of Devolutions Server versions 2026.2.16 and earlier. This flaw allows an authenticated user without the view-password permission to retrieve cleartext passwords by sending a specially crafted request to the entry listing endpoint with password disclosure parameters.
AI Analysis
Technical Summary
CVE-2026-90969 describes an improper access control vulnerability in Devolutions Server 2026.2.16 and earlier. The vulnerability exists in the vault entry listing feature, where an authenticated user lacking the required view-password permission can obtain cleartext passwords by making a request to the entry listing endpoint that includes password disclosure parameters. This indicates a failure to properly enforce permission checks on sensitive data retrieval.
Potential Impact
An authenticated user without explicit permission to view passwords can access cleartext passwords stored in the vault. This compromises the confidentiality of sensitive credentials managed by Devolutions Server, potentially leading to unauthorized access to systems and services that rely on those credentials.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions carefully to minimize exposure. Monitor vendor communications for updates on patches or official mitigations.
Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the… (CVE-2026-90969)
Description
An improper access control vulnerability exists in the vault entry listing feature of Devolutions Server versions 2026.2.16 and earlier. This flaw allows an authenticated user without the view-password permission to retrieve cleartext passwords by sending a specially crafted request to the entry listing endpoint with password disclosure parameters.
Affected software
pkg:github/devolutions/serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-90969 describes an improper access control vulnerability in Devolutions Server 2026.2.16 and earlier. The vulnerability exists in the vault entry listing feature, where an authenticated user lacking the required view-password permission can obtain cleartext passwords by making a request to the entry listing endpoint that includes password disclosure parameters. This indicates a failure to properly enforce permission checks on sensitive data retrieval.
Potential Impact
An authenticated user without explicit permission to view passwords can access cleartext passwords stored in the vault. This compromises the confidentiality of sensitive credentials managed by Devolutions Server, potentially leading to unauthorized access to systems and services that rely on those credentials.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions carefully to minimize exposure. Monitor vendor communications for updates on patches or official mitigations.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hfw6-c783-wrw2
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-90969"]
- State
- PUBLISHED
Threat ID: 6aaa07e955bf5e2cf5ea345f
Added to database: 09/16/2026, 03:07:21 UTC
Last enriched: 09/16/2026, 04:58:13 UTC
Last updated: 09/16/2026, 05:01:22 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.