Improper Access Control via Public API Key leads to Mass PII Disclosure
An unauthenticated PII disclosure issue was found in a public web portal backed by a production API gateway. The frontend exposed a public gateway key, and a pre-auth user lookup endpoint trusted that key while returning full user records for a broad email search instead of a masked or boolean response. A single unauthenticated request could return approximately 1.6k user records, including names, email addresses, internal user IDs and mobile phone numbers. The issue was accepted as High severity with CVSS 7.5 and rewarded with €400.
Description
A public single-page application exposed its production API gateway key inside an unauthenticated frontend configuration file.
Using that key, a pre-authentication endpoint intended to perform a simple user-existence check accepted a client-controlled email parameter and returned full user records instead of a boolean response or a masked result.
The expected behavior appeared to be: submit the current user’s exact email address and receive a yes/no authorization result. The actual behavior was broader: the backend performed a substring search and returned every matching record with unmasked PII. Supplying a broad match value returned almost the entire user population in a single unauthenticated request.
No login, session cookie, user token or OTP was required.