CVE-2026-74242 is an authorization bypass vulnerability in Red Hat Quay where an authenticated repository administrator can, by knowing or guessing a notification's UUID, read sensitive notification configuration details such as webhook URLs, Slack tokens, and email addresses. Additionally, the attacker can trigger test notifications for other repositories. The vulnerability is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). Exploitation requires knowledge of a specific 128-bit UUID, which reduces the probability of successful attacks despite the high confidentiality impact. Red Hat has not provided an official fix or mitigation that meets their product security criteria.

The vulnerability allows unauthorized disclosure of sensitive notification configuration data and potential misuse of notification services by triggering test notifications on other repositories. The confidentiality impact is high, but integrity and availability are not affected. The attack complexity is high due to the need to guess or know the UUID, and the attacker must have low-level privileges (repository administrator). There are no known exploits in the wild.

Red Hat currently does not offer an official fix or mitigation that meets their criteria for ease of use, deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates. Since exploitation requires knowledge of a specific UUID and authenticated repository administrator privileges, limiting access to repository administrators and safeguarding UUIDs may reduce risk. No direct mitigation is available at this time.