RansomLook Improper Filtering of Private Location Entries in API Endpoints Leads to Information Exposure

A vulnerability exists in RansomLook versions prior to 1.9.0, where the API improperly manages private location entries. This issue arises in 'website/web/api/genericapi.py', where the code removes items from a list while iterating over it. As a result, entries designated as private may inadvertently remain in API responses, leading to unauthorized exposure of non-public location data.

Impact

This vulnerability allows for the unauthorized disclosure of sensitive location information that is meant to be private.

Remediation

Users can upgrade to RansomLook version 1.9.0 or later to address this vulnerability.