Improper Access Control via Client-Supplied Document Identifier Leads to PII Disclosure
An unauthenticated Improper Access Control vulnerability was identified in a public mobile onboarding API. A registration action accepted a client-controlled document identifier and returned the associated identity profile without requiring a valid session, authorization token, or onboarding token.
Description
POST /[mobile-gateway]/[onboarding]/v2/[add-new-client] is an endpoint used by the mobile onboarding flow to create or continue a new customer registration. This operation should require a valid onboarding session, but it accepted the standard mobile-client request envelope and a body containing a document identifier without requiring valid authentication or an onboarding token.
By changing only the DocumentNumber value, the backend processed the request and returned the associated PersonData object. Fake authentication/token headers returned the same result, which indicated that those values were not being verified. For the tested document type, BirthDate was not used as an effective control, reducing the lookup key to the raw document number. Invalid documents returned a different response, creating an existence oracle.