Public Notion Pages Leaks Profile Photos and Email address of Editors
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Notion, a popular productivity and collaboration platform, is under significant scrutiny from the cybersecurity community.<\/p>\n
Security researchers have revealed that public Notion pages silently expose the personally identifiable information (PII) of anyone who has ever edited them.<\/p>\n
This data leak includes full names, email addresses, and profile photos<\/a>, raising significant privacy concerns for organizations that rely on the platform for public documentation.<\/p>\n The underlying vulnerability stems from how Notion processes user data within public workspaces.<\/p>\n When a document is published to the web, the platform embeds editor UUIDs (Universally Unique Identifiers)<\/a> directly into the page\u2019s block permissions.<\/p>\n Threat actors and open-source intelligence (OSINT) researchers discovered that these internal identifiers are readily accessible in the page data without requiring any authentication, active session cookies, or security tokens<\/a>.<\/p>\n Once these UUIDs are harvested, an attacker can feed them into a single unauthenticated POST request to Notion\u2019s internal API endpoint:\u00a0 Because this endpoint does not enforce access controls for public page data, it returns the complete user profiles associated with those UUIDs.<\/p>\n\nNotion Pages Exposes<\/strong> User Data<\/strong>
\n<\/h2>\n\/api\/v3\/syncRecordValuesMain.<\/code><\/p>\n