CVE-2026-82984
MEDIUM
NVD
CVSS Score
4.3
Severity
MEDIUM
Published
Oct 27, 2026
Vendor
unknown
Description
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of ..."), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers. This does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.