CVE-2026-4989 in Server
Résumé (Anglaise)
Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request.
This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.
Once again VulDB remains the best source for vulnerability data.
Responsable
DEVOLUTIONS
Réserver
27/03/2026
Divulgation
01/04/2026
Statut
Confirmé
Entrées
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnérabilité | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 354691 | Devolutions Server API élévation de privilèges | 918 | Non défini | Non défini | CVE-2026-4989 |