CVE-2026-71460

/api/v2/config/ is protected only by IsAuthenticated.
              license_info (account_number, subscription_id, pool_id,
              sku, support_level, instance counts) returned to any
              authenticated user. The superuser/auditor gate only covers
              project_base_dir/project_local_paths/custom_virtualenvs,
              not license_info. Enables social engineering against
              Red Hat support and estate sizing reconnaissance.