Aeonframework

An issue exists where the endpoint "/api/external-link/task/:taskId" returns the `integration.config` to any workspace member, including those with the viewer role, when a task is linked to a Gitea issue or pull request. The `integration.config` is returned in plaintext and contains the Gitea `accessToken` and `webhookSecret`. This allows unauthorized users to perform Gitea actions granted to the token and create forged webhook deliveries that pass HMAC (Hash-based Message Authentication Code) verification, which is a mechanism used to verify the integrity and authenticity of a message.

In multi-organization deployments, a console not in self-hosted mode attaches the server's internal key to requests containing an Authorization header before validating the bearer. Certain service-only routes trust this key and extract the organization identity directly from the URL. This allows a remote, unauthenticated caller to use a fabricated bearer to rewrite another organization's provider connection to an attacker-controlled endpoint. Consequently, subsequent prompts may be disclosed, and attacker-controlled responses can influence tasks. The affected API endpoints include 'PUT /v1/orgs/{org}/connections/{name}', 'PUT /v1/orgs/{org}/policy/{backend}', and all routes under '/internal/*'.