MongoDB Query Logs & Schema Leak via Unauthenticated Endpoint #3249406 Valid Information Disclosure Low 2025-09-17 – 43 Customer can cancel a individual booking in a batch, causing locking of partner. #3295503 Valid Input Validation and Logic Medium 2025-11-20 – 49 Lack of minimum value bid wheel verification on customer_bid in Rental Trips #3328343 Valid Input Validation and Logic Low 2025-11-20 – 55 Lack of Feedback Validation Permits Arbitrary Driver Ratings #2894018 Valid Insecure Direct Object Reference Medium 2025-06-12 – 60 Bypassing Bronze Partner Wallet Restriction to Accept Trips with Negative Balance #2868164 Valid Input Validation and Logic Medium 2025-06-13 – 63 Exposed trip_no in WebSocket Responses Leading to Excessive information Disclosure #2209750 Valid Access Control Medium 2025-06-26 – 64 Ability to increase any customer offered fare (BAC) #2861888 Valid Insecure Direct Object Reference Medium 2025-06-13 – 76 Improper Access Control Allows Trip Hijacking and Passenger/Driver PII Disclosure #2867022 Valid Insecure Direct Object Reference Medium 2025-06-26 – 80 Critical Information Disclosure via /talos/api/v1/files/upload #3228011 Valid Information Disclosure Critical 2025-09-17 – 97 Broken Access Control (IDOR) in Booking Detail and Bids Could Leads to Sensitive Information Disclosure #2374730 Valid Insecure Direct Object Reference High 2025-06-13 – 108 IDOR on in-app hardcoded zombie endpoint #3085742 Valid Insecure Direct Object Reference Medium 2025-06-13 – 128