CVE-2026-6706

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0...

CVE-2026-6706

Improper access control in the vault documentation feature of Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request. This vulnerability affects versions 2026.1.6.0 through 2026.1.14.0 , as well as versions throu...

EUVD-2026-26049

Improper access control in the vault documentation feature in Devolutions Server 2026.1.14.0 and earlier allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request...

CVE-2026-6706

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0...

PT-2026-35724

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.1.14.1 Description Improper access control in the vault documentation feature allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request...

manager.allowedVaults check missing for add/remove strategy

Handle 0xRajeev Vulnerability details Impact The manager.allowedVaults check is missing for add/remove strategy like how it is used in reorderStrategies. This will allow a strategist to accidentally/maliciously add/remove strategies on unauthorized vaults. Given the critical access control that i...