What is GHSA-9v47-334m-r224?

GHSA-9v47-334m-r224 is a security advisory published by GitHub Security Advisories with unknown severity. Insufficient protection of sensitive information in the user list endpoint in Devolutions Server ...

Which CVE IDs does GHSA-9v47-334m-r224 cover?

GHSA-9v47-334m-r224 covers the following CVE IDs: CVE-2026-114485. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

GHSA-9v47-334m-r224unknown

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server ...

Vendor

GitHub Security Advisories

Published

October 22, 2026

Last Modified

October 22, 2026

🔗 CVE IDs covered (1)

CVE-2026-114485 →

📋 Description

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-114485
https://devolutions.net/security/advisories/DEVO-2026-0037
https://github.com/advisories/GHSA-9v47-334m-r224