CVE-2026-92759

SecObserve, an open-source vulnerability management platform, fails to strip the basic_auth_password field from API configuration responses in its ApiConfigurationSerializer. Any product member with view-only permissions can therefore call standard REST endpoints and retrieve the decrypted basic-auth password of configured scanner or integration service accounts. An attacker holding a low-privileged account gains working credentials for the connected scanner or integration services, which can enable further access to those upstream systems. All SecObserve deployments running versions before 1.59.1 are affected. No public proof-of-concept or exploitation has been reported, and the issue is not in CISA's KEV catalog.

What to do: Upgrade SecObserve to version 1.59.1 or later. Rotate the basic-auth credentials of all scanner and integration service accounts configured in SecObserve, since any view-only member may have already been able to read them via the REST API. Review product member roles and confirm low-privileged users only have the access they need.