Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.2

Hiperdino REST API can reveal customers' contact details

CVE-2026-12258 · published 13 days ago
Summary

The public "customer/check" function in Hiperdino's version 1.0 REST API will return a person's email address and phone number if you supply a matching telephone number or email, even though only a static token is needed to use it. Because there is no limit on how often it can be called, someone with that token could collect contact information for many users. To protect data, treat the token as secret, restrict its use, add proper authentication and rate limits, or disable the endpoint if it is not needed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
hiperdino rest api 1.0
Original advisory text
Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value en...
Inadequate access control in Hiperdino’s REST v1.0 API. The public endpoint ‘customer/check’ could allow an authenticated attacker to enter a telephone number or an email address. When the value entered belongs to a registered customer, the service returns the associated information (email address and telephone number). No authentication is required beyond a static bearer token, and there is no rate limiting or generic error handling. Successful exploitation of this vulnerability could allow a remote attacker to enumerate a user’s contact details, although this would require obtaining a valid static bearer token, constituting an information disclosure vulnerability.
References
Severity
9.2 Critical
Exploitation
EPSS <1%
Type
CWE-284Improper Access Control
Timeline
Published14 Sep 2026
Updated27 Sep 2026
First seen14 Sep 2026
Sources
CVE-2026-12258 · NVD
CVE-2026-12258 · MITRE
Track software like this
Free during beta