GHSA-v549-87g2-g95q

A base member may read an assigned application's configuration. That access should not reveal the plaintext password used to pull from its private Docker registry.

Commit c968a275 removed passwords from the registry, buildRegistry, and rollbackRegistry relations returned to service readers. Applications using a direct Docker image store equivalent private-registry credentials in the application row itself.

findApplicationById() still selects the top-level username, password, and registryUrl columns. application.one returns that object unchanged to any base member with read access to the service, although that role has no registry permission.

application.saveDockerProvider stores the Docker registry username and password directly on the application row. These fields are separate from the optional registry, buildRegistry, and rollbackRegistry relations.