{"id":"CVE-2026-120734","title":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request th…","summary":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request th…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"adp","cwe":["CWE-319"],"vendor":"Devolutions","product":"Server","affected":["Server < 2026.3.13.0"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T19:39:42.837241Z"},"published":"2026-11-03","updated":"2026-11-06","sourceUpdated":"2026-11-06T19:40:02.842Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120734","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0039/"}],"tags":["cve.org"],"epss":0.00224,"epssPercentile":0.13088,"ingestedAt":"2026-11-05T20:33:06.450Z","slug":"CVE-2026-120734","body":"## Overview\n\nCleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.\n\n## Affected\n\n- `Server < 2026.3.13.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":235604,"id":"CVE-2026-120734","ts":1793995421163,"field":"cvss","old":null,"new":"6.5"},{"seq":235603,"id":"CVE-2026-120734","ts":1793995421163,"field":"severity","old":"none","new":"medium"}]}