A fundamental design flaw in Notion's API has been exposing the email addresses of page editors on every public document for at least four years. The issue, rediscovered and demonstrated by security researcher 'impulsive', requires no authentication. A single crafted POST request to the `syncRecordValuesMain` endpoint can return names, emails, and profile photos. From one public Notion community page, the researcher extracted 12 addresses belonging to staff, a service account, and an external contractor.

The architectural oversight is significant. Notion's permission system for public pages appears to grant access to underlying user objects without validation. The API accepts batches of up to 50 user UUIDs, has no rate limiting, and pairs with another open endpoint revealing authentication methods. This creates a scalable data harvesting vector. For enterprises using public wikis, a single script could map hundreds of employee identities.

Notion's engineering team acknowledged high severity internally but has not patched the system since it was first reported in 2022. The technical trade-off is clear: blocking unauthenticated user resolution could break embedded views or third-party integrations that rely on these public endpoints. The company prioritized seamless collaboration and sharing functionality over implementing a gate on this data layer.

This case is a system design lesson for data engineers. It highlights the risk of serving core data entities through public-facing APIs originally built for internal client synchronization. The persistence of the flaw suggests a costly refactor is required—one that involves scanning legacy pages and altering fundamental permission logic. For now, the API continues to return personal data, proving that a product's core strength—frictionless access—can become its most persistent vulnerability.

Source: Webpronews