---
id: CVE-2026-120716
title: >-
  Insertion of sensitive information into sent data in the identity provider
  user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an
  authenticated user with the delegated permission to update users from the
  identity pr…
summary: >-
  Insertion of sensitive information into sent data in the identity provider
  user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an
  authenticated user with the delegated permission to update users from the
  identity pr…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-201
vendor: Devolutions
product: Server
affected:
  - Server < 2026.3.13.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T19:35:30.199537Z'
published: '2026-11-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:35:58.297Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120716'
references:
  - url: 'https://devolutions.net/security/advisories/DEVO-2026-0039/'
tags:
  - cve.org
epss: 0.0027
epssPercentile: 0.1932
ingestedAt: '2026-11-05T20:33:06.451Z'
---

## Overview

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

## Affected

- `Server < 2026.3.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.