CVE-2026-81505: Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials

frain-dev/convoy (all versions up to and including v26.6.2, no patch available) lets any authenticated caller who is authorized on at least one project read ANY OTHER project’s “Source” record by ID via GET /api/v1/projects/{projectID}/sources/{sourceID} – regardless of whether that Source actually belongs to the project named in the URL. The response includes the Source’s full PubSub broker configuration in plaintext (AMQP/Kafka/SQS/Google credentials), with no redaction.