Unauthenticated IDOR on /appinfo/termsofuse Endpoint Exposes App Creator PII (Email Address) for Any AppSheet Application
The endpoint https://www.appsheet.com/appinfo/termsofuse?appId= does not require any authentication and does not enforce any authorization checks. By supplying any valid application ID as the appId parameter, an unauthenticated attacker can retrieve the app creator’s email address, app name, and app purpose/description — even for apps that have never been published, deployed, or shared with anyone. The terms of use page is intended for end users of a published app. However, it is accessible for private, draft, and unpublished apps where no end users exist and the creator has made no decision to expose their information publicly. This bypasses the intended publish/deploy workflow and results in unauthorized PII exposure from the moment an app is created on the platform. Vulnerability Type
CWE-284: Improper Access Control CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-639: Authorization Bypass Through User-Controlled Key (IDOR) OWASP A01:2021: Broken Access Control
Steps to Reproduce Step 1 — Create a private, unpublished app Create an app on AppSheet. Do not publish, deploy, or share it with anyone. The app remains in draft/private state with no end users. Step 2 — Obtain the app ID The app ID follows UUID format (e.g., 21815222-690c-47ab-826a-f01f268b0d58). These can be discovered through URL observation, referrer headers, or other application endpoints. Step 3 — Send an unauthenticated GET request GET /appinfo/termsofuse?appId={TARGET_APP_ID} HTTP/2 No cookies, no authentication headers, no session tokens required. Example using curl: bashcurl -s “https://www.appsheet.com/appinfo/termsofuse?appId={TARGET_APP_ID}” Step 4 — Observe PII in response The response contains:
Creator’s email address in plaintext Application name Application purpose/description (if set by the creator) Comparison With Other Endpoints Other AppSheet internal API endpoints properly enforce access controls: Endpoint ||Auth Required ||Ownership Check /internal/apps/{id}/apikeys
Cookie Returns 403 for non-owner - Secure /api/account/status Cookie Returns own data only Secure
/appinfo/termsofuse?appId=:cross_mark: None
Returns any app’s data Vulnerable
I tested appsheet hosted apps test beyond my other user accounts. THE appGuidstring=1d3aedee-e27c-4cb2-a013-e5fea6531f6f reveals hayden @ appsheet .com