CVE-2026-84713

A flaw was found in the automation-controller notification
                  subsystem. Although NotificationTemplate.notification_
                  configuration is protected from API filtering, its recipient
                  value is copied in clear text into the unprotected
                  Notification.recipients field on every send. Because the
                  credential-types endpoint is listable by any authenticated
                  user and the API filter backend traverses object relations
                  without per-hop authorization, a user with no privileges can
                  use a relational filter as a boolean count-oracle to recover,
                  character by character and across organizations, the secret
                  recipient values of other tenants' notifications — including
                  PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook
                  bearer-token URLs. This flaw affects confidentiality.