TIDES-2026-005highCVSS 7.1

Authenticated clients could read other clients' roster details

From March 18 through June 14, 2026, two staff-oriented schedule APIs required sign-in but did not require a staff role before returning enriched class-roster data.

Published Aug 7, 2026 · Last updated Aug 7, 2026

Affected surfaces

Enriched schedule date-range lookup
Enriched schedule-slot detail lookup

Affected period

March 18 through June 14, 2026

Impact

A signed-in client could have directly called the affected APIs to retrieve other clients' names, contact information, intake-completion state, booking status, and credit-source metadata for materialized slots. Tides found no evidence of exploitation.

Remediation

Tides changed enriched roster reads to require instructor or administrator access, retained minimized public booking responses, and added authorization tests for anonymous, client, instructor, and administrator callers.

Customer action

No action is required. Customers with privacy concerns may contact security@mail.tidespilates.com.

CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Acknowledgments

Tides Pilates internal security review