A flaw was found in Red Hat Quay's repository notification API endpoints. The GET and test-trigger endpoints in endpoints/api/repositorynotification.py look up notifications by UUID without verifying that the notification belongs to the repository specified in the URL path. An admin of any repository who knows or guesses a target notification's UUID can read the notification configuration (including webhook URLs, Slack tokens, and email addresses) and fire test notifications for another repository's notification. The DELETE and reset endpoints correctly scope by repository. Exploitation requires knowing a 128-bit notification UUID.