CVE-2026-48976

Summary

The flaw allows an authenticated user to read and potentially modify notifiers belonging to other tenants, exposing sensitive credentials and redirecting notifications to attacker-controlled webhooks.

Exploitability

Exploitation requires an authenticated user with access to another tenant's notifiers. The attacker must supply a valid UUID for the target notifier.

Blast radius

If exploited, the impact could be severe, as it allows the attacker to gain access to sensitive credentials and redirect notifications, potentially leading to data exfiltration or loss of service.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 0.26.0 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.