TIDES-2026-004criticalCVSS 8.7

Unauthenticated diagnostic query exposed client account data

From March 18 through June 14, 2026, a diagnostic API could return a client profile and related membership, package, and booking information when supplied with that client's email address, without requiring authentication.

Published Aug 7, 2026 · Last updated Aug 7, 2026

Affected surfaces

Client account diagnostic lookup
Membership and package status
Booking and schedule history

Affected period

March 18 through June 14, 2026

Impact

A remote unauthenticated caller who knew or guessed a customer's email address could have retrieved profile information, membership and package state, and booking history. The issue did not permit modification or release of any additional details. Tides found no evidence of exploitation after extensive investigation.

Remediation

Tides removed the diagnostic query from the public API, regenerated the deployed API surface, and added authorization regression coverage for restricted user, booking, and commerce reads.

Customer action

No action is required. Customers with privacy concerns may contact security@mail.tidespilates.com.

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Acknowledgments

Tides Pilates internal security review