Post cover image

September 16, 2026

How a Simple Bug Got Me €25

While participating in the Target.com bug bounty program, I found a simple API information disclosure issue on one of the in-scope assets.

By ameensec

The API accepted an email address and returned newsletter subscription information associated with that account.

It was a relatively simple API issue, but it was a good reminder that even small information-disclosure bugs can be worth reporting when they expose user-related data.

None

The Endpoint

GET /api/newsletter/rest/v3/users/<email>/subscriptions?state=SUBSCRIBED&representation=WIDE

The subscription API leaks sensitive user metadata based on email input. When a valid email is provided, the API returns a detailed JSON object disclosing personally identifiable information (PII) such as:

  • Subscription ID
  • Email tracking ID
  • Subscription timestamp
  • Newsletter ID and name
  • Personalized preview URL

Example response:

{
  "subscriptionId": "514c7a38-8107-4aaa-664d-f513fbae5777",
  "email": "test@example.com",
  "emailTrackingId": "32df5ddfsadse995319asdfe037f8d",
  "state": "SUBSCRIBED",
  "rootEventTimestamp": "2025-04-06T07:17:08.133Z",
  "newsletter": {
    "newsletterId": "59asdf347a69253fdsfdf86c8e6",
    "name": "ameensec",
    "previewUrl": "https://ameen.sec/optiext/optiextension.dll?..."
  }
}

Impact

The endpoint could be used to confirm whether an email address was subscribed and expose internal subscription and tracking information.

The main concern was the possibility of using the endpoint for email/subscription enumeration.