Inadequate Access Control in Hiperdino REST API

CVE-2026-12258

What is CVE-2026-12258?

The Hiperdino REST API version 1.0 exhibits a significant security flaw due to inadequate access controls. The public endpoint 'customer/check' allows authenticated attackers to input a telephone number or email address. If the provided input corresponds to a registered user, the API reveals sensitive information including the associated email and phone number. The security issue arises as only a static bearer token is required for access, without any rate limiting or proper error handling in place. Consequently, this vulnerability paves the way for remote attackers to potentially enumerate users' contact details, contingent upon their ability to obtain a valid bearer token, leading to serious privacy concerns.

References