{"id":"CVE-2026-110805","title":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne config…","summary":"Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne config…","severity":"none","cwe":["CWE-918"],"vendor":"Devolutions","product":"Server","affected":["Server < 2026.3.10"],"published":"2026-10-16","updated":"2026-10-16","sourceUpdated":"2026-10-16T13:46:53.212Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110805","references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0036/"}],"tags":["cve.org"],"ingestedAt":"2026-10-16T14:07:42.841Z","slug":"CVE-2026-110805","body":"## Overview\n\nServer-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.\n\n## Affected\n\n- `Server < 2026.3.10`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}