GHSA-wf8r-8h5f-pxqm

An organization administrator may update that organization's notification providers. Authorizing one parent notification must not permit changes to an independently supplied child provider owned by another tenant.

Every notification update accepts two independent global IDs, a parent notificationId and a provider-specific child ID such as slackId, gotifyId, or teamsId. The router authorizes only the parent. The service then updates the separately supplied child without verifying that it belongs to the authorized notification or organization.

An attacker can create an attacker-owned notification, pass its authorized parent ID together with another tenant's child ID, and replace the victim webhook, server URL, token, email credentials, or API key. Future deployment, build-error, backup, restart, cleanup, and server-threshold alerts can be redirected to the attacker or suppressed.