Threats tagged 'ghsa-hfw6-c783-wrw2'

An improper access control vulnerability exists in the vault entry listing feature of Devolutions Server versions 2026.2.16 and earlier. This flaw allows an authenticated user without the view-password permission to retrieve cleartext passwords by sending a specially crafted request to the entry listing endpoint with password disclosure parameters.