{"id":"CVE-2026-82984","aliases":[],"title":"When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ","description":"When a team was configured as \"visible to everyone\", the web UI correctly blocked non-members from viewing the team (\"You are not a member of ...\"), but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and their identifiers.\n\nThis does not grant access to the contents of the discovered resources themselves, only their existence, names, and identifiers.","severity":"medium","score":4.3,"published":"2026-10-27T16:15:34.831Z","modified":"2026-10-27T16:15:34.831Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://hackerone.com/reports/3511955"],"sources":[{"name":"CVE","id":"CVE-2026-82984","modified":"2026-10-27T16:15:34.831Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-82984"}],"assessments":[{"source":"CNA","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":4.3}]}