CVE-2026-84713

*** Pendiente de traducción *** A flaw was found in the automation-controller notification<br /> subsystem. Although NotificationTemplate.notification_<br /> configuration is protected from API filtering, its recipient<br /> value is copied in clear text into the unprotected<br /> Notification.recipients field on every send. Because the<br /> credential-types endpoint is listable by any authenticated<br /> user and the API filter backend traverses object relations<br /> without per-hop authorization, a user with no privileges can<br /> use a relational filter as a boolean count-oracle to recover,<br /> character by character and across organizations, the secret<br /> recipient values of other tenants&amp;#39; notifications — including<br /> PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook<br /> bearer-token URLs. This flaw affects confidentiality.