TalkTalk Android App Access Control Vulnerability Allowing Sensitive Data Exposure

A vulnerability in the TalkTalk Android App version 3.3.6 has been identified, involving improper access control across multiple API endpoints. This flaw allows attackers to manipulate request parameters to access sensitive user information, such as device identifiers and birthdays, as well as private group details, including join credentials. Exploiting this vulnerability could lead to privacy violations and unauthorized access to restricted resources.

Impact

Exploitation of this vulnerability could result in privacy breaches and unauthorized access to sensitive user information and private group resources.