T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- references/sug-endpoints.md:301
- Finding
- Unauthenticated disclosure of hidden participant information and withdrawal identifiers## Vulnerability Details **File Location**: `references/sug-endpoints.md`, lines 301–330 **Vulnerability Type**: Unauthenticated access to participant PII and operational identifiers **Risk Level**: Medium ### Vulnerable Snippet ```sh ### Participant names + quantities — also no auth `/v3/.../slots` gives you counts but not people. The names come from the legacy dispatcher, and it too needs **no** credentials (verified 2026-08-10 from a cold `curl`): curl -s -X POST -H 'Content-Type: application/json' \ --data '{"listid":62393618,"slotitemid":1762735194,"offset":1,"limitTo":100, "search":"","orderBy":"","orderDesc":false,"memberidViewing":0}' \ 'https://www.signupgenius.com/SUGboxAPI.cfm?go=s.getSignUpParticipantsBySlotItem' Each row carries `firstname`, `lastname`, `nonmembername`, `mycomment`, `memberid`, **`myqty`** and **`itemmemberid`**. 2. **`itemmemberid` is the `imid`** that a release/withdraw needs (§6). Note this returns names even though the same slot reports `hidenames: true` on the v3 feed, so `hidenames` is a display preference on that feed, not an access control across the API as a whole. ``` ### Technical Analysis The Skill explicitly documents an unauthenticated legacy API request that returns participant records for a selected sign-up slot. The disclosed fields include first and last names, free-form comments, membership identifiers, participation quantities, and `itemmemberid`. This crosses an access-control boundary because the request requires no credentials and returns participant identities even when the corresponding slot has `hidenames: true`. The documentation does not impose an ownership, membership, or participant-authorization check before retrieving or displaying this information. The exposed `memberid` and `itemmemberid` values are also operational identifiers used by the withdrawal endpoint documented later in the same file. The release workflow does instruc ...[truncated 1523 chars]
- Remediation
- ## Remediation Suggestions - Remove the unauthenticated participant-enumeration workflow from the Skill. - Require authentication and verify that the requesting account owns the sign-up or has an explicitly authorized administrative role before retrieving participant records. - Enforce the `hidenames` setting consistently across every API surface rather than treating it only as a presentation preference. - Return only the minimum fields necessary for the authorized task; do not expose `memberid`, `itemmemberid`, comments, or full names to unauthenticated callers. - Add server-side authorization to withdrawal-related operations and derive the participant identity from the authenticated session instead of accepting public operational identifiers as authority. - If upstream authorization cannot be changed, instruct the agent not to call this endpoint or disclose its output unless the user demonstrates appropriate ownership or participant authorization.