What is GHSA-3v3c-5gj3-fqxv?

GHSA-3v3c-5gj3-fqxv is a security advisory published by GitHub Security Advisories with Medium severity. Insertion of sensitive information into sent data in the automation jobs API in Devolutions...

Which CVE IDs does GHSA-3v3c-5gj3-fqxv cover?

GHSA-3v3c-5gj3-fqxv covers the following CVE IDs: CVE-2026-16798. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3v3c-5gj3-fqxv?

GHSA-3v3c-5gj3-fqxv has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-3v3c-5gj3-fqxvMediumCVSS 6.5

Insertion of sensitive information into sent data in the automation jobs API in Devolutions...

Vendor

GitHub Security Advisories

Published

July 24, 2026

Last Modified

July 24, 2026

🔗 CVE IDs covered (1)

CVE-2026-16798 →

📋 Description

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16798
https://devolutions.net/security/advisories/DEVO-2026-0025
https://github.com/advisories/GHSA-3v3c-5gj3-fqxv