{"id":"CVE-2026-82984","kind":"vulnerability","aliases":["CVE-2026-82984"],"related":[],"title":"Team resource API leaks resource names and IDs to non-members","description":"When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.","summary":"When a team was set to visible to everyone, the web UI hid its resources from non-members but the resources API still answered direct calls. Any logged-in non-member can list the team's internal resource names and identifiers, though not their contents.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["authenticated-users","package","teams"],"not_affected_if":["auth-required"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","triaged_at":"2026-10-27T17:34:57+00:00","updated_at":"2026-10-27T17:34:57+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-27T17:34:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Team resource API leaks resource names and IDs to non-members","impact":"low","summary":"When a team was set to visible to everyone, the web UI hid its resources from non-members but the resources API still answered direct calls. Any logged-in non-member can list the team's internal resource names and identifiers, though not their contents.","category":"package","nicknames":[],"who_cares":["teams","authenticated-users"],"confidence":0.4,"needs_auth":"yes","worst_case":"Authenticated non-members enumerate team resource names and identifiers","analyst_note":"Identify the affected product and fixed versions from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-82984; the sources give no product or version.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"who_is_affected":"Only deployments that use team visibility set to everyone and that have authenticated non-member accounts can reach the leaking endpoint. The sources do not name the affected product or versions, so the exact software to check is unknown.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000541,"input_tokens":3342,"output_tokens":414,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-82984':15A,18A 'access':129C 'allow':109C 'answer':48B 'api':3A,46B,102C 'authent':20B,111C 'authenticated-us':19B 'block':85C 'call':50B,107C 'configur':76C 'content':71B,132C 'correct':84C 'could':104C 'cve':13A,16A 'direct':49B,108C 'discov':135C 'endpoint':103C 'enumer':116C 'everyon':32B,80C 'exist':140C 'grant':128C 'hid':36B 'id':8A 'identifi':67B,124C,143C 'intern':63B,120C 'leak':4A 'list':59B 'log':53B 'logged-in':52B 'member':12A,42B,57B,88C,97C,114C 'name':6A,65B,141C 'non':11A,41B,56B,87C,113C 'non-memb':10A,40B,55B,86C,112C 'packag':22B 'resourc':2A,5A,38B,45B,64B,101C,121C,136C 'set':28B 'still':47B,105C 'team':1A,23B,26B,61B,74C,92C,118C 'though':68B 'ui':35B,83C 'user':21B 'view':90C 'visibl':30B,78C 'web':34B,82C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that use team visibility set to everyone and that have authenticated non-member accounts can reach the leaking endpoint. The sources do not name the affected product or versions, so the exact software to check is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-82984","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82984","severity":null,"published_at":"2026-10-27T17:17:03+00:00","modified_at":"2026-10-27T17:17:03+00:00","first_seen_at":"2026-10-27T17:32:47+00:00","fetched_at":"2026-10-27T17:32:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}