CVE-2026-12258

The public 'customer/check' endpoint of Hiperdino's REST v1.0 API lacks adequate access control, so anyone holding the service's single static bearer token can submit a telephone number or email address and receive the associated registered customer's contact details. Because the token is static rather than tied to an individual user, and the endpoint implements no rate limiting or generic error handling, an attacker with the token can enumerate customer email addresses and phone numbers at scale. This is a network-reachable information disclosure flaw (CVSS 4.0: 9.2, driven by high confidentiality impact) affecting registered customers of Hiperdino, a Spanish supermarket chain; exploitation requires no user interaction but does require possession of the static bearer token. No public proof of concept exists and the vulnerability is not in CISA's KEV catalog, so no exploitation is currently known.

What to do: Hiperdino should immediately revoke and rotate the static bearer token and replace it with per-customer authentication (e.g., short-lived OAuth tokens), add rate limiting, and return identical generic responses whether or not a record matches to prevent enumeration. Customers should watch for targeted phishing to their disclosed contact details, and defenders should check API access logs for bulk sequential queries against 'customer/check'. No patched version was specified in the disclosure, so monitor INCIBE and vendor advisories for a fixed API release.