Threats tagged 'ghsa-wqh4-2xq9-jpwc'

OpenPanel versions before 3.0.0 have an information disclosure vulnerability that allows users with read-level project access to retrieve sensitive integration secrets. This occurs because the notification.rules query does not properly redact integration credentials. Exploiting this flaw, attackers can obtain Slack bot tokens, webhook URLs, and authorization headers, potentially enabling unauthorized actions against external systems.