CVE-2026-44884

Name of the Vulnerable Software and Affected Versions Portainer Community Edition versions 2.33.0 through 2.33.7 Portainer Community Edition versions 2.39.0 through 2.39.0 Portainer Community Edition versions prior to 2.33.0

Description A missing authorization issue in the Custom Template file endpoint "GET /api/custom templates/{id}/file" allows any authenticated user to read the file content of any custom template. This is achieved by enumerating sequential integer IDs in the id variable, which bypasses Resource Control access restrictions. The customTemplateFile() function retrieves the template by its numeric ID and returns the content without performing an authorization check. Template files may contain sensitive environment-specific values, such as connection strings, API tokens, or registry credentials.

Recommendations Update to version 2.33.8. Update to version 2.39.1. Upgrade to a supported release. Avoid storing secrets in custom templates by moving sensitive configuration values to environment variables or an external secret store. Review existing custom templates for embedded secrets and rotate any credentials that may have been exposed.