Executive brief
Gittensory is a software tool that provides analytics and management for Gittensor miners—users who earn cryptocurrency (TAO) by contributing to a decentralized network. The application exposes a profile endpoint and an AI-powered tool that fails to verify that an authenticated user should be allowed to access another miner's financial data. Any authenticated user can view any other miner's daily earnings in TAO, alpha tokens, and USD equivalent, as well as their wallet keys in some cases, without authorization. This allows attackers with valid credentials to conduct competitive intelligence or target other miners for exploitation.
Technical details
The vulnerability is an authenticated Insecure Direct Object Reference (IDOR) / missing access control (CWE-284) affecting two endpoints: the REST API route GET /v1/contributors/:login/profile and the MCP (Model Context Protocol) tool gittensory_get_contributor_profile. Both endpoints omit the requireContributorAccess authorization check that is enforced on all sibling endpoints in the codebase. The vulnerable buildContributorProfile function embeds the miner's hotkey, alphaPerDay, taoPerDay, and usdPerDay fields; on the REST endpoint these are fully exposed, and on the MCP tool the financial fields leak despite the redactSensitiveForMcp filter (which only strips certain key names). An authenticated attacker with a valid session, API, or MCP token can enumerate any miner's daily revenue figures and (via REST) their hotkey without additional privileges or user interaction. A proof-of-concept demonstrates that a successful request to the profile endpoint returns 200 with sensitive data, while a cross-contributor request to the decision-pack endpoint correctly returns 403. The vulnerability was patched in commit 811ef5f by adding requireContributorAccess guards to both surfaces and extending redactSensitiveForMcp to strip financial fields from all MCP output.
Affected products
- JSONbored gittensory <= 0.1.0
Timeline
- 2026-07-09: disclosed: Advisory published on GitHub Security Advisory and OSV database
- 2026-06-02: patched: Fix merged in commit 811ef5fb9d748170011f8854d88c64627ad666a0 with requireContributorAccess enforcement and sensitive field redaction