CVE-2026-74242

Name of the Vulnerable Software and Affected Versions Red Hat Quay (affected versions not specified)

Description An Insecure Direct Object Reference (IDOR) exists where a repository administrator can access notification configurations of other repositories by knowing or guessing the Universally Unique Identifier (UUID) of a target notification. This allows the unauthorized reading of sensitive data, such as webhook URLs, Slack tokens, and email addresses, and enables the triggering of test notifications for repositories they do not manage. IDOR is a type of access control flaw where an application uses user-supplied input to access objects directly without sufficient authorization checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.