GHSA-6947-4ch9-7px7

A member with deployment-history access may inspect an assigned application's rollbacks. That response should not contain plaintext credentials for its image registries.

Commit c968a275 removed registry passwords from service-level API responses, but changed createRollback() to fetch all three registry records with credentials and persist them inside rollback.fullContext.

The ordinary deployment-history query joins the complete rollback row and returns it to any member with deployment:read on the application. The application deployment page polls this query, so the response discloses the plaintext registry, build-registry, and rollback-registry passwords without requiring registry permission.

createRollback() resolves registryId, buildRegistryId, and rollbackRegistryId through findRegistryByIdWithCredentials() and writes the resulting objects to the JSON fullContext column. The deployment-history query then joins the complete rollback row and returns it.