Executive brief
Gittensory, a tool for managing Gittensor miner data, contains a security flaw where authenticated users can view the private financial profiles of other miners. This includes sensitive information such as daily earnings in TAO, alpha, and USD, as well as technical hotkeys. An attacker with any valid account could use this to systematically collect financial data on all participants in the network, potentially impacting user privacy and competitive positioning.
Technical details
An Insecure Direct Object Reference (IDOR) vulnerability exists in Gittensory due to missing authorization checks in the `GET /v1/contributors/:login/profile` REST endpoint and the `gittensory_get_contributor_profile` MCP tool. While sibling endpoints correctly implement `requireContributorAccess`, the profile handler in `src/api/routes.ts` omits this check, returning data from `buildContributorProfile` to any authenticated session. The REST path leaks the `hotkey`, `alphaPerDay`, `taoPerDay`, and `usdPerDay` fields. The MCP tool also lacks the access gate and, while it redacts the hotkey, it fails to filter the three financial `*PerDay` fields. Attackers require a valid authentication token to exploit this and enumerate miner data.
Affected products
- JSONbored @jsonbored/gittensory-mcp <= 0.1.0
Timeline
- 2026-06-02: disclosed: Initial disclosure to vendor
- 2026-07-09: advisory: GitHub Advisory published