every public Notion page is leaking the email addresses of everyone...
impulsive@weezerOSINT
219 views
Apr 22, 2026
~1 min read
Advertisement
1
every public Notion page is leaking the email addresses of everyone who edited it.
zero authentication. no cookies. no tokens. one POST request returns full names, emails, and profile photos for every editor on the page.
your company wiki is public? every employee's email is exposed. right now.
reported in 2022. still works in 2026. like what is the point of even having a BBP
thread
zero authentication. no cookies. no tokens. one POST request returns full names, emails, and profile photos for every editor on the page.
your company wiki is public? every employee's email is exposed. right now.
reported in 2022. still works in 2026. like what is the point of even having a BBP
thread
2
notion's API returns editor UUIDs in the permissions of any public page. no auth needed.
i hit their own Community page. got 13 user IDs from block permissions. fed them into /api/v3/syncRecordValuesMain.
12 emails back. notion employees, a production service account (svc-notion-prod@makenotion.com), and an external contractor. all from one page.
i hit their own Community page. got 13 user IDs from block permissions. fed them into /api/v3/syncRecordValuesMain.
12 emails back. notion employees, a production service account (svc-notion-prod@makenotion.com), and an external contractor. all from one page.
3
notion pages are everywhere. company wikis, job boards, public docs, onboarding guides. google "site:notion.site" and you get thousands.
every one of those pages is silently leaking editor emails to anyone who sends one unauthenticated API call.
enterprise workspace with 500 employees sharing a public page? that's 500 corporate emails in a single request. no rate limiting. batch 50 users at a time.
pair it with getLoginOptions (also zero auth) and you know which ones use passwords vs SSO. credential stuffing just got a free target list.
every one of those pages is silently leaking editor emails to anyone who sends one unauthenticated API call.
enterprise workspace with 500 employees sharing a public page? that's 500 corporate emails in a single request. no rate limiting. batch 50 users at a time.
pair it with getLoginOptions (also zero auth) and you know which ones use passwords vs SSO. credential stuffing just got a free target list.
4
the original report was filed on HackerOne. July 28, 2022. almost 4 years ago.
notion triaged it as "informative." no fix. no CVE. no bounty.
i independently found the same bug. reported it. marked duplicate.
tested again today. still returns emails. same endpoint. same zero auth.
if your team has a public notion page, your emails are exposed. check your sharing settings.
notion triaged it as "informative." no fix. no CVE. no bounty.
i independently found the same bug. reported it. marked duplicate.
tested again today. still returns emails. same endpoint. same zero auth.
if your team has a public notion page, your emails are exposed. check your sharing settings.
5
this 11 billion dollar company made a business decision to leave customer PII exposed.
6
@NotionHQ Just close your Bug Bounty Program
