[pentest] Password-protected and unlisted pastes are exposed in public listings /api/public #65

Closed
opened 2026-09-09 14:10:09 +00:00 by poslop · 1 comment
Owner

GET /api/public lists pastes regardless of visibility settings:

  • A password-protected paste (API GET returns password required) appears in /api/public with its title, size, view_count.
  • An unlisted paste (unlisted: true) likewise appears.

Repro: create {"content":"pwtest","password":"hunter2","title":"pw"} -> it shows up in GET /api/public?limit=50 with title "pw". Same for an unlisted paste.

Impact: metadata of protected content leaks to everyone; titles often reveal content. Protected/unlisted pastes should be excluded from public listings.

`GET /api/public` lists pastes regardless of visibility settings: - A password-protected paste (API GET returns `password required`) appears in /api/public with its **title, size, view_count**. - An unlisted paste (`unlisted: true`) likewise appears. Repro: create `{"content":"pwtest","password":"hunter2","title":"pw"}` -> it shows up in `GET /api/public?limit=50` with title "pw". Same for an unlisted paste. Impact: metadata of protected content leaks to everyone; titles often reveal content. Protected/unlisted pastes should be excluded from public listings.
Author
Owner

Landed via PR #71/#fix landed (merged to main).

Landed via PR #71/#fix landed (merged to main).
Sign in to join this conversation.