Executive brief
A social or community platform's circle (group) membership feature is vulnerable to unauthorized disclosure. An authenticated attacker can guess circle identifiers and retrieve membership lists for groups they don't belong to, potentially exposing user relationships and group composition to unauthorized parties.
Technical details
This vulnerability is an information disclosure / enumeration flaw in a circle (group) membership API endpoint. The root cause is insufficient authorization checks combined with a predictable or brute-forceable identifier scheme. An authenticated user can construct requests with guessed circle identifiers (described as 62^15 possible values, suggesting base-62 alphanumeric strings) and retrieve membership information without membership validation. While the identifier space is large, it is computationally feasible to enumerate. The attack requires prior authentication but no specific group membership, allowing lateral discovery of sensitive social graph data.
Affected products
- <UNKNOWN>
Timeline
- 2026-09-18: disclosed