Sensitive Customer Data Exposure Through a Reservation XLSX Export

About Me

Hi, I'm Mohamed Elasswy (0xfalcon), a Cybersecurity Researcher and Bug Bounty Hunter focused on Web Application Security and API Security. I actively hunt for real-world vulnerabilities and share my findings with the security community.

Introduction

I Changed One ID — And Downloaded Another Restaurant's Customer Data

While testing a restaurant reservation platform, I found an XLSX export feature that generated reservation data through this endpoint:

POST /api/v1/restaurants/<restaurant_id>/reservations/export

POST /api/v1/restaurants/<restaurant_id>/reservations/export

The interesting part was the restaurant_id.

I first exported my own restaurant's reservations successfully. Then I changed the ID to another valid restaurant identifier while keeping the same authenticated session.

POST /api/v1/restaurants/<my_restaurant_id>/reservations/export

POST /api/v1/restaurants/<my_restaurant_id>/reservations/export

became:

POST /api/v1/restaurants/<another_restaurant_id>/reservations/export

POST /api/v1/restaurants/<another_restaurant_id>/reservations/export

The server accepted the request and generated an XLSX file for the other restaurant.

What Was Exposed?

The file contained reservation and customer information, including:

• Customer names
• Reservation notes
• Allergy information
• Internal restaurant notes
• Number of people
• Areas / tables
• Reservation status

No privilege escalation or authentication bypass was required.

The issue was an IDOR / Broken Object-Level Authorization (BOLA): the server trusted the user-controlled restaurant_id without properly verifying whether the authenticated user was authorized to access that restaurant.

Impact

An authenticated user could access another restaurant's reservation data through the export endpoint, potentially exposing sensitive customer and internal restaurant information.

The vulnerability was reported responsibly and was rewarded with CHF 3,000 ($3,660).