Priority LOW 25
An issue that could allow a credential to be updated and used for a task from outside of the authorized organization scope has been resolved.
CVSS 3.1MEDIUM 5.8· Network · High privileges · No interaction · EPSS 0.00216 · Published 2026-04-07 · Fixed in 4.0.26021.0 CWE-863
Priority LOW 20
An issue that could allow access to Explorer groups from outside of the authorized organization scope has been resolved.
CVSS 3.1MEDIUM 4.4· Network · High privileges · No interaction · EPSS 0.00182 · Published 2026-04-07 · Fixed in 4.0.260208.0 CWE-863
Priority LOW 14
An issue that could expose records outside of the authorized organization scope through the MCP endpoints has been resolved.
CVSS 3.1LOW 3.0· Network · High privileges · No interaction · EPSS 0.00177 · Published 2026-04-07 · Fixed in 4.0.260206.0 CWE-863
Priority LOW 11
An issue that could expose task information outside of the authorized organization scope has been resolved.
CVSS 3.1LOW 2.2· Network · High privileges · No interaction · EPSS 0.00177 · Published 2026-04-07 · Fixed in 4.0.260205.0 CWE-863
Priority LOW 23
An issue that could allow an authorized user to view the clear-text secrets for a subset of credential types and fields has been resolved.
CVSS 3.1MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.002 · Published 2026-04-07 · Fixed in 4.0.260204.2 CWE-863
Priority LOW 14
An issue that allowed MCP agents to access certificate information from outside of their authorized organization scope has been resolved.
CVSS 3.1LOW 3.0· Network · High privileges · No interaction · EPSS 0.0012 · Published 2026-04-07 · Fixed in 4.0.260203.0 CWE-863
Priority LOW 29
An issue that allowed administrators to create and update users outside of their authorized organization scope has been resolved.
CVSS 3.1MEDIUM 6.8· Network · High privileges · No interaction · EPSS 0.00195 · Published 2026-04-07 · Fixed in 4.0.260203.0 CWE-863
Priority LOW 28
An issue that could prevent session inactivity timeouts from triggering due to automatic page reloading has been resolved.
CVSS 3.1MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.00216 · Published 2026-04-07 · Fixed in 4.0.260203.0 CWE-613
Priority LOW 13
An issue that could allow a user with access to a credential to view sensitive fields through an API response has been resolved.
CVSS 3.1LOW 2.7· Network · High privileges · No interaction · EPSS 0.00204 · Published 2026-04-07 · Fixed in 4.0.260203.0 CWE-200
Priority LOW 25
An issue that allowed MCP agents to access remediation and asset information from outside of the authorized organization scope has been resolved.
CVSS 3.1MEDIUM 5.8· Network · High privileges · No interaction · EPSS 0.00216 · Published 2026-04-07 · Fixed in 4.0.260202.0 CWE-863
Priority LOW 38
An issue that allowed all-organization administrators to promote accounts to superuser status has been resolved.
CVSS 3.1HIGH 8.4· Network · High privileges · User interaction · EPSS 0.00224 · Published 2026-04-07 · Fixed in 4.0.260202.0 CWE-269
Priority LOW 30
An issue that allowed a SQL injection attack vector related to saved queries (introduced in version 4.0.260123.0).
CVSS 3.1MEDIUM 6.4· Network · High privileges · User interaction · EPSS 0.00206 · Published 2026-04-07 · Fixed in 4.0.260123.1 CWE-89
THREATIST.IORead the docs