The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint.
Credits
Zabbix wants to thank sebiee for submitting this report on the HackerOne bug bounty platform.
