CVE-2026-56783

Name of the Vulnerable Software and Affected Versions Parseable versions prior to 2.9.2

Description An information disclosure issue exists in the notification-target API endpoints where webhook tokens and basic-auth credentials are returned in cleartext. This occurs because the secret-masking functionality was commented out. Any authenticated user with the GetAlert action, including those with low-privilege reader roles, can recover credentials and internal endpoint URLs for all configured notification targets by querying the 'GET /api/v1/targets' endpoint or related endpoints.

Recommendations Update to version 2.9.2 or later.