// disclosure

Findings

Vulnerabilities identified during security research. Most organisations are anonymised; named findings were disclosed through official vulnerability disclosure programs.

DEWR

Department of Employment and Workplace Relations · Official VDP
Broken access control · information disclosure
  • The production API returned the full account list without authentication, including names, emails, ABNs and physical addresses.
  • The pre-production environment allowed open self-registration without Digital ID and granted sessions access to sensitive contact and account APIs.
  • Publicly exposed CIAM API documentation revealed DEWR's identity infrastructure, including invitation, passkey and B2C tenant operations.
  • Affected the Federal Safety Officer Online portal used by accredited users and companies.

Online training provider

IDOR · broken access control · hard-coded AWS keys
7.4M files ~650K users
  • IDOR in the documents API exposed approximately 7.4 million files spanning 2014–2026, including resumes, assessments, voice and video uploads, USI numbers and education records.
  • IDOR in the meeting and communication endpoints leaked user details and allowed arbitrary email sending.
  • Hard-coded AWS keys in client-side JavaScript allowed listing and overwriting compliance documents in S3.
  • Broken access control exposed the entire user base through a list endpoint.
  • Affected users included welfare recipients across two platforms, approximately 650,000 accounts.

DCCEEW

Department of Climate Change, Energy, the Environment and Water · Official VDP
IDOR · authorization bypass
  • IDOR in the Invoice Payment System allowed any authenticated user to retrieve other customers' invoices by changing a sequential invoice ID.
  • The ownership check could be bypassed by supplying an empty accountNumber parameter.
  • Exposed invoice amounts, payment status, customer reference numbers and PDFs containing company and buyer details.
  • The issue was present in both production and pre-production environments.

State law enforcement agency

SSRF · log injection · broken access control
  • Publicly reachable API documentation exposed sensitive routes for person lookup, criminal history, payments and audit records.
  • Debug mode leaked stack traces, on-disk paths and framework versions.
  • Blind SSRF allowed the backend to reach internal Azure infrastructure, enabling internal network and port enumeration.
  • Unauthenticated logging endpoints allowed log injection and flooding.
  • A publicly accessible GIS service exposed operational data including CCTV locations and stream URLs, officer details, incident and intelligence fields.

National gym chain

Hard-coded AWS keys · permissive Cognito role · broken access control
100K–250K users 5.3M files
  • Production source maps exposed hard-coded AWS IAM keys and the full GraphQL schema.
  • GraphQL queries returned full PII, bank account and card details, door-access logs, SMS history and contract records.
  • A Cognito identity pool issued unauthenticated AWS credentials with access to 5.2M member contracts and ABA banking files.
  • An unauthenticated CMS endpoint allowed enumeration of temporary-user records by sequential ID.
  • Estimated exposure covered 100,000–250,000 users and approximately 5.3 million files.

National supermarket chain

Hard-coded credentials · mobile application
443,332 users
  • Hard-coded API key provided elevated backend access, including a user-lookup endpoint supporting bulk enumeration.
  • Embedded Mailchimp credentials exposed subscriber metadata, including IP and GPS data.
  • A third key allowed arbitrary email to be sent from the company's trusted domain.
  • Combined exposure affected approximately 443,332 users.

Major mining company

Broken access control · SSRF · unauthenticated write access
~6,000 employees ~8,000 vehicles
  • Unauthenticated admin routes exposed approximately 1,000 accounts and allowed creating admin users, modifying roles and reassigning vendors.
  • An SSRF in the token endpoint allowed requests to cloud metadata and internal services.
  • Unauthenticated APIs exposed employee records, contractor data and fleet details, including supervisor information, mine-site assignments and compliance documents.
  • Write and delete routes allowed adding vehicles, uploading attachments and deleting compliance documents without authentication.
  • Exposure covered approximately 6,000 employees, 700 contracted companies and 8,000 tracked vehicles.

National energy company

Broken access control · unauthenticated GraphQL API
~3,000 users ~10,000 documents
  • An unauthenticated GraphQL endpoint returned roughly 3,000 user records with names, corporate email, banking details and live password-reset tokens.
  • Approximately 10,000 supplier documents were downloadable, including bank confirmations, ABN documents and approval records.
  • Live reset tokens enabled account takeover, including potential backoffice admin access.
  • The API also exposed approximately 2,200 vendor and 10,500 approval records.

Named findings were disclosed through official VDPs. No user data or exploit details are published.