Nightingale (n9e) before 9.0.0-beta.2 allows any authenticated Standard role user to retrieve complete datasource configurations via the POST /api/n9e/datasource/list endpoint. The response contains plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys because the route lacks an admin authorization gate and the DatasourceFilter does not hide secret fields. The exposed credentials enable an attacker to access connected downstream systems, compromising confidentiality and integrity. This vulnerability is a case of missing authorization (CWE-862).

The product Nightingale from vendor ccfos:nightingale is affected in all releases prior to 9.0.0-beta.2. Versions 9.0.0-beta.2 and newer contain the fix.

The CVSS score of 7.1 indicates a high severity. No EPSS information is available, and the vulnerability is not listed in CISA KEV, suggesting no confirmed exploits yet. The likely attack vector requires only a low‑privilege authenticated user to call the unsecured endpoint; the attacker does not need elevated privileges. The disclosed credentials provide a clear path to compromise downstream systems, posing significant risk to confidentiality, integrity, and availability.