{"id":"CVE-2026-110805","title":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne config…","summary":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne config…","severity":"low","cvss":2.6,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N","cvssSource":"adp","cwe":["CWE-918"],"vendor":"Devolutions","product":"Server","affected":["Server < 2026.3.10"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-16T15:07:50.474633Z"},"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:08:11.754Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110805","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0036/"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T14:07:42.841Z","epss":0.00124,"epssPercentile":0.02115,"slug":"CVE-2026-110805","body":"## Overview\n\nServer-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.\n\n## Affected\n\n- `Server < 2026.3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":14,"depthScoreParts":{"impact":14.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":223079,"id":"CVE-2026-110805","ts":1792172030882,"field":"cvss","old":null,"new":"2.6"},{"seq":223078,"id":"CVE-2026-110805","ts":1792172030882,"field":"severity","old":"none","new":"low"}]}