Opto 22 groov View Exposure of Sensitive Information Through Metadata

The groov View API exposes users' API keys through a public endpoint that requires only Editor-level access. An attacker with Editor permissions can retrieve secret API keys for all users, including administrators, compromising account security.

The /users endpoint in groov View API returns sensitive metadata including plaintext or insufficiently protected API keys for all users regardless of role hierarchy. An authenticated attacker with Editor privileges can enumerate and extract API credentials for administrative accounts, leading to unauthorized access and privilege escalation.