{"id":"CVE-2026-17569","aliases":["EUVD-2026-49379","GHSA-552f-mjvj-8m37"],"status":"published","title":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated...","description":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.\n\nThis issue affects :\n\n  *  Devolutions Server 2026.2.4.0 through 2026.2.12.0\n  *  Devolutions Server 2026.1.23.0 and earlier","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.0027,"percentile":0.19442,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-522"],"published":"2026-07-27T17:37:19Z","modified":"2026-10-24T13:10:00Z","products":[{"vendor":"devolutions","product":"devolutions_server"},{"vendor":"devolutions","product":"server"}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0026/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-17569"},{"url":"https://devolutions.net/security/advisories/DEVO-2026-0026"},{"url":"https://github.com/advisories/GHSA-552f-mjvj-8m37"}],"sources":{"cve":[{"id":"CVE-2026-17569","description":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.\n\nThis issue affects :\n\n  *  Devolutions Server 2026.2.4.0 through 2026.2.12.0\n  *  Devolutions Server 2026.1.23.0 and earlier","status":"published","published":"2026-07-27T17:37:19.772Z","modified":"2026-07-28T13:45:03.527Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:19:54.84674Z"}],"euvd":[{"id":"EUVD-2026-49379","description":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.\n\nThis issue affects :\n\n  *  Devolutions Server 2026.2.4.0 through 2026.2.12.0\n  *  Devolutions Server 2026.1.23.0 and earlier","status":"published","published":"2026-07-27T17:37:19Z","modified":"2026-07-28T13:45:03Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"ghsa":[{"id":"GHSA-552f-mjvj-8m37","title":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated...","description":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.\n\nThis issue affects :\n\n  *  Devolutions Server 2026.2.4.0 through 2026.2.12.0\n  *  Devolutions Server 2026.1.23.0 and earlier","status":"published","published":"2026-07-27T18:31:50Z","modified":"2026-07-28T15:33:16Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T15:09:52.627235Z"}],"nvd":[{"id":"CVE-2026-17569","description":"Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint.\n\nThis issue affects :\n\n  *  Devolutions Server 2026.2.4.0 through 2026.2.12.0\n  *  Devolutions Server 2026.1.23.0 and earlier","status":"published","published":"2026-07-27T18:16:54.393Z","modified":"2026-10-24T13:10:00.147Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-522"],"updated_at":"2026-11-02T14:12:33.249634Z"}]}}