CVE-2026-12258: Inadequate access control in the Hiperdino REST API
Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling. Successful exploitation of this vulnerability could allow a remote attacker to enumerate a user’s contact details, although this would require obtaining a valid static bearer token, constituting an information disclosure vulnerability.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid static bearer token to call the public customer/check endpoint. With that token, they can submit telephone numbers or email addresses and identify registered customers.
What information can be disclosed?
For values associated with registered customers, the API returns the customer’s email address and telephone number. The lack of generic error handling can also help distinguish registered values from non-registered ones.
Why is large-scale enumeration a concern?
The endpoint has no rate limiting, allowing repeated requests with candidate email addresses or telephone numbers. This can enable remote enumeration of customer contact details by an attacker who has obtained a valid bearer token.