Leak exposes 1,000+ customer emails via unfiltered API query

Tier B · Patch this week – Put it in the sprint

Who’s exposed: hiddenweb customers' emails and multi-tenant store data, over 1,000 records

Tier B because: Exploited in the wild OR public exploit

Reach

Attack

Damage

Fix

Public exploit · Secrets exposed

What to do

Review your APIs for client-controlled query parameters that return unrestricted table data

The Brief

A researcher found a database leak at hiddenweb by changing one query parameter (?select=*) in API traffic.
The accessible database reportedly held over 1,000 customer emails in cleartext, plus private multi-tenant store data.
The author mentions responsible disclosure, but the source text is truncated and does not confirm a fix.

Why it matters

APIs that return full table contents when a query parameter changes can expose customer personal data and data from other tenants. Developers should enforce column and row restrictions on the server side rather than trusting client-supplied query parameters.

The checklist behind the tier

Checklist · 3 of 10 yes

Yes	Hits tech teams	Judgment: hiddenweb is a multi-tenant store backend, a SaaS service that developers and ops teams run.
No	Core infrastructure	Judgment: a single store platform's API, not core infrastructure like OpenSSH or GitHub.
No	Popular tool	Judgment: hiddenweb is a niche product, not a widely used framework or platform.
No	Exploited in the wild	DEV Community: the author describes a discovery and responsible disclosure, not observed attacks.
Yes	Public exploit	DEV Community: the write-up publishes the exact query technique (?select=*) step by step.
No	Remote, no login	DEV Community: no source states that unauthenticated access is enough, so not confirmed.
No	Full takeover	DEV Community: the reported impact is data access, with no code execution or admin takeover.
Yes	Secrets exposed	DEV Community: over 1,000 cleartext customer emails and private multi-tenant store data were exposed.
No	Supply chain	DEV Community: a database query flaw, with no compromised package, update or build pipeline.
No	No fix yet	DEV Community: the sources do not say the flaw remains unpatched.

Source

How I Discovered a Leak Exposing 1,000+ Customer Emails via a Simple API Query (?select=*) ↗ DEV Community: backend · 3h ago

First seen 3h ago · 1 source · Full story page · How tiers are decided