CVE-2026-3131
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to acc…
Published Feb 24, 2026 · updated Jun 17, 2026 · devolutions devolutions server
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 24, 2026 · NIST NVD
Detected
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data.
Jun 17, 2026 · NIST NVD
Updated
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data.
Affected
- cpe devolutions/devolutions serverversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-3131
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3131
Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access sensitive connection data.
nvd.nist.gov