TLDR Tech / InfoSec
A DoD Contractor's API Flaw Exposed Military Course Data and Service Member Records
Schemata, an AI-powered virtual training platform for military and defense settings, exposed sensitive DoD data due to missing authorization checks in its API. The exposed data includes user listings, organization records, course information, training metadata, and direct links to documents from Schemata's AWS environment. The researchers were able to use a low-privileged account to request high-value data belonging to other customers via the API.
Read the full story