T05 · Unauthorized Access and Privilege Escalation
- Location
references/sug-endpoints.md:306- Finding
Unauthenticated Retrieval of Hidden Participant Identities
- Content
View full analysis
Vulnerability Details
File Location:
references/sug-endpoints.md, lines 306–333
Vulnerability Type: Unauthenticated access to participant identity and signup metadata
Risk Level: MediumVulnerable Code Snippet
sh curl -s -X POST -H 'Content-Type: application/json' \ --data '{"listid":62393618,"slotitemid":1762735194,"offset":1,"limitTo":100, "search":"","orderBy":"","orderDesc":false,"memberidViewing":0}' \ 'https://www.signupgenius.com/SUGboxAPI.cfm?go=s.getSignUpParticipantsBySlotItem'The accompanying instructions state:
Each row carries
firstname,lastname,nonmembername,mycomment,memberid,myqtyanditemmemberid.They further state:
Note this returns names even though the same slot reports
hidenames: trueon the v3 feed, sohidenamesis a display preference on that feed, not an access control across the API as a whole.Technical Analysis
The documented endpoint accepts a signup identifier (
listid) and slot-item identifier (slotitemid) without an authorization token or session cookie. Its response contains participant names, comments, membership identifiers, quantities, and item-member identifiers.The same reference documents unauthenticated endpoints for discovering public signup and slot identifiers. Consequently, the identifiers needed for this request are not secret authorization capabilities. The participant endpoint also exposes identities when the corresponding slot reports
hidenames: true, crossing the privacy boundary represented by the organizer's hidden-name setting.This is a reachable unauthorized data-access workflow rather than credential exfiltration by the Skill. The reviewed files contain no evidence that the project author operates the remote endpoint or intends to perform a covert attack; therefore, the project is classified as suspicious rather than malicious.
Attack Path
- Identify ...[truncated 1301 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the unauthenticated participant-enumeration workflow and live example identifiers from the Skill documentation.
- Do not request or display participant identities when the associated signup or slot has hidden-name settings enabled.
- Require an authenticated session and verify that the caller is the signup owner or otherwise authorized before retrieving participant-level data.
- Apply server-side authorization independently of identifier secrecy;
listid,slotitemid,memberid, anditemmemberidmust not be treated as access-control tokens. - Minimize response fields to those necessary for the authorized operation, omitting names, comments, and internal identifiers where possible.
- Add rate limiting, access logging, pagination limits, and enumeration detection to the remote endpoint.
- If the Skill retains participant-management functionality, direct the agent to verify authorization and privacy settings before every request and avoid exposing participant data in logs or unrelated output.