Sensitive user information disclosure at bonjour.uber.com/marketplace/_rpc via the 'userUuid' parameter

Summary

It was possible for an attacker to insert another user’s UUID into the userUuid POST parameter when making a request to https://bonjour.uber.com/marketplace/_rpc?rpc=getConsentScreenDetails, allowing them to retrieve personal data from the victim user’s account, as well as the user's mobile auth token, which could allow them to make requests to mobile APIs as the victim.

Thanks again, @appsecure_in!

Public API endpoint leaked mobile API token of a user by passing driver uuid/rider uuid in the request. Using the API token attacker could have gained full access to driver/rider account.