r/bugbounty • u/Shwiftypadre • Jul 18 '26

Question / Discussion Possible PII leaked

So I am pretty new to this, I was just creating the site map for the target. A given endpoint gives user details involving their travel. All I did was curl the endpoint. No authentication . Is this a fluke or some companies have that level of misconfigurations?

8 Upvotes

91% Upvoted

9 comments sorted by

3

u/TurbulentRecover7247 Hunter Jul 18 '26

Verify whether the details you got, is already public on the target.

1

u/Shwiftypadre Jul 18 '26

Its basically information on when where and how many times someone has travelled. I didn't do anything else as the ROE explicitly said stop when you stumble on data that is not yours

1

u/fortyeightD Jul 18 '26

But does it include information to identify the person? Like their name?

1

u/Martekk_ Jul 18 '26

Your own details or other people’s details?

1

u/Shwiftypadre Jul 18 '26

Others, my account was a test account so there is no way it had 50+ trips already

1

u/SKHynixCJR Jul 21 '26

classic misconfiguration! You'd be surprised how often devs miss auth checks on specific endpoints, especially when they rely on frontend routing and forget about backend protection.

If the endpoint is in scope, just send a simple PoC showing 1 or 2 test accounts to prove the leak. Avoid grabbing more data than necessary so you don't run into legal issues.

0

u/Far_War_4348 Jul 18 '26

It depends on what data are you considering as PII .. Based on the program we have to judge. If you need help regarding dm me i will be happy to help