Slack Webhook URL Disclosure to Regular Members via integrations.list and integrations.info

Summary

An authenticated regular workspace member can read the secret Slack webhook URL of an administrator-created workspace integration.

In Outline, the endpoints POST /api/integrations.list and POST /api/integrations.info are accessible to any authenticated user in the workspace. The integration presenter returns the integration settings object without redacting secret values. As a result, a non-admin member can retrieve the Slack webhook URL configured by an administrator.

Because a Slack webhook URL is a secret credential, its disclosure can allow a regular member to send unauthorized messages to the linked Slack channel or workflow.

Root Cause

The issue is caused by a combination of overly broad read authorization and an unredacted presenter.

File: server/routes/api/integrations/integrations.ts

Routes:

• integrations.list
• integrations.info

Both routes require only auth() and do not enforce an administrative role.

File: server/policies/integration.ts

The integration read policy allows any user in the same workspace to read an Integration model:

allow(User, "read", Integration, isTeamModel);

Reproduction

Test environment:

• one admin user
• one regular member in the same workspace

Step 1: Create a Slack integration as admin

Request:

POST /api/integrations.create HTTP/1.1
Host: localhost:3003
Content-Type: application/json
Authorization: Bearer 

{
  "type": "slack",
  "service": "slack-post",
  "settings": {…