Restaurant Brands International Assistant Platform Global Store Directory Information Sharing Vulnerability
Vulnerability
A vulnerability exists in the Restaurant Brands International (RBI) assistant platform's Global Store Directory, which, through September 6, 2025, improperly shares personal information among authenticated users. This issue affects the platforms of Burger King, Tim Hortons, and Popeyes, all managed under RBI.
Impact
Exploitation of this vulnerability allows authenticated users to access and share personal information, including voice recordings of drive-thru orders, which may contain background conversations and personally identifiable information.
Remediation
RBI has reportedly fixed these vulnerabilities, but details on the specific remediation steps are not available.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.