CVE-2026-100286

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

  • Published Sep 29, 2026
  • CVSS 6.5 medium
  • 0.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-100286 at the National Vulnerability Database