Sensitive information exposed at [███] via /export_panelists_to_xlsx endpoint

Summary

An information disclosure vulnerability was identified that allowed unauthorized access to personally identifiable information through an unprotected API endpoint. The vulnerability exposed user email addresses and telephone numbers via a /export_panelists_to_xlsx endpoint that lacked proper authentication and authorization controls. The issue was classified under CWE-312 (Cleartext Storage of Sensitive Information) with a CVSS score of 6.1 (Medium severity). The vulnerability was successfully reproduced, validated by the security team, and subsequently remediated. We appreciate the researcher's responsible disclosure, which helped protect user privacy and strengthen our security posture.