sensitive-data-exposure

August 10, 20262 min read

[Insufficient Authorization] Unauthenticated Data API Exposes Real-Name Rosters and Staff Contacts

Masked FVE record: a data API with no authentication or authorization returned real-name rosters of residents' association officers, facility staff contacts and employee numbers in bulk.

Read full article

June 7, 20262 min read

[Personal Data Exposure] Resident-Number-Based Linking Information Exposed by a Missing Authentication-Level Check

Masked FVE record: a missing authentication-level check let an anonymous session read a victim's resident-number-based linking information (CI) and identity details.

Read full article