Security · High impactFan score 43 · Tier B
How I Discovered a Leak Exposing 1,000+ Customer Emails via a Simple API Query (?select=*)
The Brief
- A researcher found a database leak at hiddenweb by changing one query parameter (?select=*) in API traffic.
- The accessible database reportedly held over 1,000 customer emails in cleartext, plus private multi-tenant store data.
- The author mentions responsible disclosure, but the source text is truncated and does not confirm a fix.
Why it matters
APIs that return full table contents when a query parameter changes can expose customer personal data and data from other tenants. Developers should enforce column and row restrictions on the server side rather than trusting client-supplied query parameters.
Who’s affected
- hiddenweb customers
- multi-tenant store operators using hiddenweb
What to do
- Review your APIs for client-controlled query parameters that return unrestricted table data
- #security
- #api
- #data-leak
- #multi-tenant
- #pii
While inspecting the web traffic of hiddenweb , I stumbled upon a major database security flaw. By changing a single query parameter, I was able to access a leaked database containing over 1,000 cleartext customer emails and private multi-tenant store data. Responsible Disclosure…