Live › vulnerability › CVE-2026-82984
Go to dashboardWhen a team was set to visible to everyone, the web UI hid its resources from non-members but the resources API still answered direct calls. Any logged-in non-member can list the team's internal resource names and identifiers, though not their contents.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 17:32 UTC. All times on this page are UTC.
Only deployments that use team visibility set to everyone and that have authenticated non-member accounts can reach the leaking endpoint. The sources do not name the affected product or versions, so the exact software to check is unknown.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.
This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.
This page as .md · .json · in your agent: get_signal("CVE-2026-82984")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.