CVE Catalog
CVE-2026-23922
LowCVSS 2.1Summary
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
Risk Assessment
A Super Admin can leak sensitive credentials, potentially leading to unauthorized access to email accounts.
Recommendation
Update to a version that resets the client secret when changing the token endpoint and restrict Super Admin privileges.
Original NVD description (English source)
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.