Phase Console versions up to 2.77.3 suffer from a missing authorization check that permits users without Secrets read permission to query the secretHistory GraphQL endpoint. This flaw allows the attacker to retrieve historical secret events, and with an environment key they can decrypt the payloads, exposing sensitive credential history. The vulnerability directly compromises confidentiality by letting privileged data be read by unauthorized organization members.

The affected product is Phase Console, provided by Phase, and the vulnerability is known to impact version 2.77.3. No additional affected versions are listed in the current data.

The CVSS score of 6.0 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The missing authorization flaw is exploitable by anyone with an environment key; they can provide a known secret identifier to the secretHistory GraphQL query, retrieve encrypted secret events, and decrypt them using the wrapped environment key. The likely attack vector is application-level insider or compromised account exploiting the lack of permission checks.