CVSS 4.3 (medium) · published 2026-10-27
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
Weakness: CWE-284
Source: NVD CVE-2026-82984
Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.