Phase Console EUVD-2026-99251

Exploitation requires the attacker to already be an authenticated member of the target Phase Console organisation who possesses a wrapped environment key for the affected environment but lacks the Secrets read permission, and who can supply a valid/known secret identifier to the secretHistory GraphQL query. Limiting factors that reduce real-world risk: valid organisation membership and prior environment-key access are prerequisites (PR:L), a known secret identifier must be supplied (reflected as AT:P in the CVSS 4.0 vector), and no public exploit is confirmed. This is an insider/over-privileged-member authorization-escalation condition rather than remote unauthenticated exploitation; it affects deployments through version 2.77.3 that rely on the Secrets read permission to compartmentalise secret visibility.

This is a genuine but moderate-severity authorization flaw (CVSS 4.0 base 6.0, CWE-862 Missing Authorization), not an overstated high-CVSS issue. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) is internally consistent with the description: exploitation is network-reachable but requires an already-authenticated low-privilege organisation member (PR:L) who additionally holds a wrapped environment key and knows a valid secret identifier (reflected by AT:P, attack requirements present). The impact is confidentiality-only (VC:H, VI:N/VA:N) - an attacker can read and decrypt historical secret values they were not authorised to see, but cannot modify data or affect availability. No EPSS score is provided in the input, no CISA KEV listing exists, and no public exploit code is confirmed (the referenced hackmd document and VulnCheck advisory are technical disclosures, not verified weaponised exploits). The signals are mutually consistent: a medium-privilege insider/authz-escalation issue with meaningful but bounded data exposure. Real priority is situational - high for organisations relying on Phase Console's role separation to restrict secret visibility among members, low as a broad internet-wide threat because exploitation presupposes existing org membership and environment-key access.

A low-privileged member of a Phase Console organisation who holds an environment key but was explicitly denied the Secrets read permission issues a secretHistory GraphQL query with a known secret identifier. The backend fails to enforce the read authorization check, returning encrypted secret events that the member then decrypts locally using their wrapped environment key, exposing current and historical secret values. No public exploit code is identified at time of analysis, though a technical write-up is referenced.