CVE-2026-17569

MediumCVSS 4.3/10Last modified Oct 24, 2026

Description

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.

This issue affects :

* Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Devolutions	Server	< 2026.1.24; >= 2026.2.4.0, < 2026.2.14

References

https://devolutions.net/security/advisories/DEVO-2026-0026/Vendor Advisory

Timeline

Published: Jul 27, 2026
Last modified: Oct 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-17576.2A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is CVE-2026-175704.3Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose CVE-2026-175716.1The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected C CVE-2026-175725.5Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a de CVE-2026-175735.5A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via CVE-2026-175745.5HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-leng CVE-2026-175766.5The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13 CVE-2026-175776.1The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' (and 'host') parameters in versions up to, an CVE-2026-175782.3Kong Event Gateway versions 1.0.0 through 1.1.1 and 1.2.0 do not enforce key rotation before reaching NIST SP 800-38D recommended usage limi CVE-2026-17588.3Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation. This issue affects GateManager: 11.5;0, 1 CVE-2026-175806.5The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver…CVE-2026-175817.2The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Code Injection via the 'thermal' Template Engin