CVE-2026-110210: Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known secret identifier to retrieve encrypted secret events and decrypt values using their wrapped environment key.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An organisation member who does not have Secrets read permission can exploit it if they hold an environment key and know a secret identifier.
What information can an attacker obtain?
The attacker can use the secretHistory GraphQL query to retrieve encrypted secret events for a known secret identifier. They can decrypt the values using their wrapped environment key.
Is an environment key alone sufficient?
No. The described attack also requires organisation membership and a known secret identifier; the affected member does not need Secrets read permission.