Post #557837

2026-03-06 17:43 UTC

I just found a security breach that can leak thousands of emails on a website!! Today, I snooped around on a website I won't mention the name of for privacy reasons, and they assign your account an user ID when you register. Well, with a very simple trick in the console I managed to get everyone else's email and account info (for example checking if they have a paid plan or not) by just lowering the user id, with no rate-limit on the endpoint! So a bad actor could send targetted phishing emails to people by telling them there is a problem with their payment! It's funny because on their homepage, they state they use "Military grade encryption" (whatever that means!), and their privacy policy says "We encrypt the transmission of that information" (does that just mean they do it over https?) So, moral of the story, don't trust companies with your personal info! I contacted the site, we'll see if they fix it. @privacy@lemmy.ml @privacy@lemmy.world @soatok@furry.engineer #cybersecurity #privacy #web #hacking

Replies (7)

@CodenameDarlen@lemmy.world 2026-03-06 18:10

Is this AI? Something feels off.

Open ##557972
@hansolo@lemmy.today 2026-03-06 18:41

I appreciate this post, but this is also a lot of “trust me, bro” to…well, trust.

Open ##558152
@Zerush__dup_9179@lemmy.ml 2026-03-06 19:52

Email is always a traceable identification if you don’t use an mail with alias features.

Open ##558632
@bamboo__dup_13640@lemmy.blahaj.zone 2026-03-06 19:53

In addition to letting the website owner know about the issue, I would reach out to Troy Hunt with your evidence, so the data can be loaded into Have I Been Pwned and the affected people notified.

Open ##558638
@TiredTiger@lemmy.ml 2026-03-06 21:27

If the website in question belongs to a tech/hardware company, you could consider reaching out to Gamers Nexus (after you’ve given the owners of the site a reasonable amount of time to address the issue). They’ve published this kind of stuff in the past.

Open ##559436
@kiszkot@feddit.nu 2026-03-06 23:13

Based on the description this seems to be improper authorisation. An authenticated user can access data that it’s not supposed to (I assume you need to log in to see the data). The site in question should have a security contact where you can send your proven finding. Something like security@company.com or cert@company.com. They will usually require GPG encryption so the misconfigurstion you are reporting is not snooped (the attachment should be enough).

Open ##561590
@jarinks@mstdn.social 2026-03-23 01:13

@helloyanis@furries.club @privacy @soatok@furry.engineer IDOR with no endpoint limiting how is that website still up

Open ##2528881