TIDES-2026-003highCVSS 6.0

Private file URLs lacked per-file authorization

From March 18 through April 21, 2026, an authenticated file-serving API verified sign-in but did not independently authorize each requested private storage object.

Published Aug 7, 2026 · Last updated Aug 7, 2026

Affected surfaces

Authenticated private-file URL resolution
Avatar, intake, support, and report attachments

Affected period

March 18 through April 21, 2026

Impact

A signed-in attacker who obtained another object's opaque storage identifier could have requested a temporary signed URL. Potential objects included avatars, intake signatures, and support or report attachments. Tides found no evidence of exploitation.

Remediation

Tides added a file-ownership registry, backfilled existing references, recorded ownership for every private upload, and now authorizes each URL request against ownership, public status, administrator access, or an explicitly permitted staff context.

Customer action

No action is required. Customers with concerns about a private attachment may contact security@mail.tidespilates.com.

CVSS 4.0

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Acknowledgments

Tides Pilates internal security review