{"id":"CVE-2026-82984","published":"2026-10-27T17:17:03.290","lastModified":"2026-10-27T17:17:03.290","description":"When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://hackerone.com/reports/3511955","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}