SecObserve versions prior to 1.59.1 have an information disclosure vulnerability in the ApiConfigurationSerializer component. This flaw causes the basic_auth_password field to be included in API configuration responses without being stripped. As a result, users with view-only access can retrieve decrypted basic-auth passwords of configured scanner or integration service accounts via standard REST endpoints.