CVE-2026-92759

Medium

Description

SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints.

SeverityMedium

CVSS6.5

Exploit probability40. percentile0.5%

ProductSecObserve

PublishedSep 16, 2026

First seenSep 16, 2026

Weakness typeCWE-522CWE-522

How to fix

Update

SecObserve SecObserve1.59.1 or later

Vendor advisories

github.com/SecObserve/SecObserve/security/advisories/GHSA-r968-78vw-jj9m
github.com/SecObserve/SecObserve/releases/tag/v1.59.1

Affected products

Product	Affected versions	Fixed in
SecObserve SecObserve	1.17.0 ≤ v < 1.59.1	1.59.1

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.