CVE-2026-23922: Email media OAuth secret leak to Super Admin
Published Aug 18, 2026
·Updated
The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
Event History
Aug 18, 2026
CVE Published
via MITRE·12:13 PM
Data Sourced
via MITRE·12:13 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue, and what access is required?
Super Admins who can modify the email media OAuth configuration are exposed to this issue. The leak requires changing the Token endpoint to a malicious value after a Client secret has been saved.
2
What mitigation is available if the fix cannot be applied immediately?
Changing the Token endpoint now resets the stored Client secret. If patching is not immediately possible, avoid changing the Token endpoint for configurations containing a saved Client secret and restrict Super Admin access to trusted administrators.