IDOR - Scheduled data leak to other accounts By "projectID"

Summary

An Insecure Direct Object Reference (IDOR) vulnerability was discovered in the GetNotebookScheduledPaginatedJobs endpoint on backend.singlestore.com. By modifying the projectID parameter in API requests, an authenticated user could access scheduled job information belonging to other users' projects. The API failed to verify whether the requestor had permission to access the specified project.

The vulnerability exposed sensitive information including database names, notebook paths, scheduling details, and infrastructure information. While exploitation required knowledge of valid project IDs, which limited the practical impact, the issue still represented an authorization bypass warranting remediation.

This medium-severity issue has been patched by implementing proper authorization checks.