Summary

There is a publicly available Swagger API on /vaccination-manager/api.php. The API isn't public so this swagger UI should not be public either. This Swagger UI lets us know about endpoint /vaccination-manager/api/vax-proof-list.php. An attacker can look at PII for any user who has uploaded a proof of vaccination using this endpoint, and there is no requirement for authentication or authorisation to access the information.

Steps to reproduce

1. Go to vaccination-manager/pub/upload-vaccination-proof.php and upload a document.
2. Send a get request to /vaccination-manager/api/vax-proof-list.php and observe PII info of users who uploaded the info in step 1:

Impact

The publicly available Swagger UI gives an attacker information about a private API endpoint. Using this endpoint, the PII information of any user who uploads a proof of vaccination is accessible by anyone, without any form of authentication or authroisation.