The role "CI-driven scan initiator" provides excessive read access

Summary

The reporter noticed that all authenticated users are able to access certain non-sensitive information such as metadata about which third-party integrations are enabled.

This is by design, but we have updated our documentation to make it clear what information is available to all authenticated users: https://portswigger.net/burp/extensibility/enterprise/graphql-api/index.html#:~:text=following%20non%2Dsensitive-,information,-%3A

CI-driven scan initiator role have only one permission which is [ start scan ] However, i was able using a user with this role to disclose dashboard agent pools and administrator integeration configuration via capabilities, read access to full used, uploaded extension details