CVE-2026-11890

MediumCVSS 4.3/10Last modified Oct 25, 2026

Description

Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-882 CWE-284

Affected software

Vendor	Product	Versions
Devolutions	Devolutions Server	< 2026.2.5; < 2026.1.21

References

https://devolutions.net/security/advisories/DEVO-2026-0017/Vendor Advisory

Timeline

Published: Jun 16, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1189048.1IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentic CVE-2026-1189057.0Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `n CVE-2026-118915.1Use After Free vulnerability in Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driver allows a non-pri CVE-2026-118935.9The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, v CVE-2026-1189388.8In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example "Values.read_file") is r CVE-2026-118945.9The Realtek BEE Bluetooth HCI driver's send callback, bt_hci_bee_send() in drivers/bluetooth/hci/hci_bee.c, violated the bt_hci_driver_api b CVE-2026-1189474.3A flaw was found in the UMA resource registration endpoint of the keycloak-services component, which provides the core logic for Keycloak's CVE-2026-118956.4The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi CVE-2026-1189526.5A flaw was found in the Kroxylicious ACL authorizer. Its prefix-matching logic may apply a rule to a principal of a different type, or fail CVE-2026-1189595.4A flaw was found in the required action provider mechanism of Keycloak. The issue occurs when an authorization request includes the kc_actio CVE-2026-118965.3The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and CVE-2026-1189659.4Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of