this post was submitted on 25 Jul 2026
455 points (98.9% liked)

Technology

87251 readers
4605 users here now

This is a most excellent place for technology news and articles.

Our Rules

  1. Follow the lemmy.world rules.
  2. Only tech related news or articles.
  3. Be excellent to each other!
  4. Mod approved content bots can post up to 10 articles per day.
  5. Threads asking for personal tech support may be deleted.
  6. Politics threads may be removed.
  7. No memes allowed as posts, OK to post as comments.
  8. Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
  9. Check for duplicates before posting, duplicates may be removed
  10. Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago
MODERATORS
L3s@lemmy.world
enu@lemmy.world
technopagan@lemmy.world
L4s@lemmy.world
L3s@hackingne.ws
455
Pope's official prayer app commits cardinal sin, leaks 700K+ users' info (www.theregister.com)
submitted 3 weeks ago by stermy4u@lemmy.world to c/technology@lemmy.world
70 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] Zarobi@aussie.zone 45 points 3 weeks ago* (last edited 3 weeks ago) (17 children)

the API endpoint GET [redacted] will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else's data,” she wrote.

This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That's it. That's the exploit.”

My God, that's horrific. Plus it doesn't even delete your data if you delete your account, it's still vulnerable.

[–] Zeoic@lemmy.world 6 points 3 weeks ago (3 children)

5 digit user ids, yet over 700k users? Im sure they must have gone up to 6 digits

[–] ViatorOmnium@piefed.social 6 points 3 weeks ago

I tried the endpoint. 5 digits always gives you a valid user, 6 stops working after some point.

[–] Zarobi@aussie.zone 4 points 3 weeks ago* (last edited 3 weeks ago)

They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it's just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting INTEGER.MAX_VALUE for your customer ID is a good problem to have

[–] Earthwormjim91@lemmy.world 2 points 3 weeks ago (2 children)

Unless by “digit” they mean any alphanumeric.

You’ve got a lot of options if you go to a 5 characters with letters.

Which they’d kind of have to with 700k users if it’s 5 characters.

If it’s case insensitive, you’ve got 60,000,000+ combinations, and if case sensitive then 916,000,000+ combinations.

[–] ViatorOmnium@piefed.social 4 points 3 weeks ago (1 children)

It's numerical only, but the number doesn't need leading 0s so anything from 1 to 6 digits might be a valid user ID.

[–] Earthwormjim91@lemmy.world 2 points 3 weeks ago

That would be an absolute nightmare to administer lol. Though I guess that tracks.

1, 01, 001, 0001, and 00001 would all be different users

[–] Zeoic@lemmy.world 1 points 3 weeks ago

Good point, could easily be hex or some higher base

load more comments (13 replies)