Unauthenticated Create, Read, and Delete of Any User's Data + Email Relay on JPL Hurricane Watch

Disclosed by

Engagement National Aeronautics and Space Administration (NASA) - Vulnerability Disclosure Program
Disclosed date 1 Sep 2026 11 days ago
Priority P1 Bugcrowd's VRT priority rating
Status Resolved This vulnerability has been accepted and fixed

Summary by Aman12321

Identified a broken access control vulnerability (P1/Critical) on a NASA/JPL production web application. The application's API allowed unauthenticated users to create, read, and delete any user's saved data using only a name as the identifier - with no session, cookie, or token required. Additionally, an unauthenticated email relay endpoint was discovered. The issue was triaged, confirmed, and resolved by NASA's security team.

Unauthenticated Create, Read, and Delete of Any User's Data + Email Relay on JPL Hurricane Watch

Summary by Aman12321

Activity