CVE-2026-92759 PUBLISHED

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.

• George Chen finder

• GitHub Issue #4799
• https://github.com/SecObserve/SecObserve
• GitHub Security Advisory (GHSA-r968-78vw-jj9m)
• to_representation pops api_key but not basic_auth_password
• SecObserve v1.59.1 Release Notes
• VulnCheck Advisory: SecObserve before 1.59.1 Information Disclosure via API Configuration

• Insufficiently Protected Credentials CWE