Description

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-13T17:17:26.730Z",
  "pubdate": "2026-08-13T17:17:26.730Z",
  "executiveSummary": "An information disclosure vulnerability exists in the /members API endpoint due to an incomplete remediation applied in PR #38145.\nThe flaw allows unauthorized or improperly restricted access to private organization member lists, leading to the exposure of sensitive user data.\nThis impacts organizational privacy and user confidentiality by permitting unauthorized enumeration of internal platform participants.\nRisk implications include potential reconnaissance operations against private organizations, facilitating downstream targeted social engineering or unauthorized access attempts.\nAttackers require network access to the target API endpoint to exploit the flawed authorization or filtering logic.\nNo complex exploitation prerequisites are necessary beyond interacting with the vulnerable /members endpoint.",
  "technicalDetails": "The vulnerability resides in the authorization and data filtering logic of the /members API endpoint, which was previously patched under PR #38145.\nThe root cause stems from an incomplete fix where the underlying API controller fails to adequately validate the requester's membership status or organizational visibility permissions before serializing and returning member lists.\nBecause the patch introduced in PR #38145 did not comprehensively cover all edge cases or parameter combinations, the endpoint still leaks private organizational membership details.\nExploitation occurs when an actor sends an HTTP request directly to the /members endpoint.\nDue to the absent or bypassed access controls, the application processes the query and returns a JSON payload or similar data structure containing sensitive identifiers and attributes of private organization members.\nThe attack flow requires no advanced payloads; a standard HTTP GET request directed at the exposed resource is sufficient to elicit the unauthorized data response.\nNetwork exposure is remote, as the API endpoint is accessible over standard web protocols.\nAuthentication and privilege requirements depend on the specific context of the implementation, but the vulnerability indicates that even unauthorized or low-privileged users can extract information meant strictly for authorized internal administrative contexts.\nPost-exploitation impact involves the aggregation of internal user directories, enabling threat actors to map organizational structures and identify high-value targets for subsequent attacks."
}