CVE-2026-6706 - AskarLabs CVE Database

CVE-2026-6706

Vendor Devolutions

Product Server

Weakness CWE-862 · Missing authorization

Published April 28, 2026

Last update April 30, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.

Key dates

02Disclosure timeline

April 28, 2026 CVE published

April 30, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-6706 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Identifiers

CVE CVE-2026-6706

CWE CWE-862

Affected versions

Vendor Devolutions

Product Server

Affected ≥ 2026.1.6.0 and ≤ 2026.1.14.0

Vendor Devolutions

Product Server

Affected ≤ 2025.3.18.0