CVE-2026-56783 affects parseable versions before 2.9.2. The vulnerability arises from the notification-target API endpoints returning sensitive information such as webhook tokens and basic-auth credentials in cleartext. This occurs due to the secret-masking feature being disabled via commented-out code. Authenticated users with the GetAlert action, even those with minimal privileges, can exploit this by making GET requests to /api/v1/targets or related endpoints to retrieve credentials and internal URLs for all configured notification targets. This represents a significant information disclosure risk.

The vulnerability allows disclosure of sensitive authentication credentials and internal endpoint URLs to any authenticated user with the GetAlert permission, including low-privilege roles. This exposure can lead to unauthorized access to notification targets and potentially further compromise of the system or connected services. The CVSS 4.0 base score is 7.1, indicating a high severity impact due to network attack vector, low attack complexity, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects parseable versions prior to 2.9.2, upgrading to version 2.9.2 or later is recommended once a fix is officially released. Until then, restrict the GetAlert permission to trusted users only to limit exposure. Monitor vendor channels for an official fix or temporary mitigation instructions.