---
id: CVE-2026-120734
title: "Cleartext transmission of sensitive information in the email configuration test in Devolutions Server\_2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request th…"
summary: "Cleartext transmission of sensitive information in the email configuration test in Devolutions Server\_2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request th…"
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: adp
cwe:
  - CWE-319
vendor: Devolutions
product: Server
affected:
  - Server < 2026.3.13.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T19:39:42.837241Z'
published: '2026-11-03'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:40:02.842Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120734'
references:
  - url: 'https://devolutions.net/security/advisories/DEVO-2026-0039/'
tags:
  - cve.org
epss: 0.00224
epssPercentile: 0.13088
ingestedAt: '2026-11-05T20:33:06.450Z'
---

## Overview

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

## Affected

- `Server < 2026.3.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.