Missing Authorization in Phase Console by Phase Technologies

CVE-2026-110210

What is CVE-2026-110210?

Phase Console versions up to 2.77.3 are susceptible to a missing authorization flaw that permits unauthorized organization members to access secret history through the secretHistory GraphQL query. This vulnerability allows attackers with access to an environment key to exploit a known secret identifier, enabling them to retrieve and decrypt sensitive secret events using their wrapped environment key. Such exposure could lead to potential data leaks and unauthorized access to confidential information, posing significant security risks for affected organizations.

References