Open registration flaw in CoopCycle exposed customer home addresses across tenants

·1 views

A security researcher, Santosh Kumar Puppala, discovered that the GET /api/stores/{id}/addresses endpoint in CoopCycle's open-source delivery platform carried no authorization check, unlike every other operation on the same resource. Because self-registration is open, any authenticated user could enumerate store IDs and retrieve customer names, street addresses, and postcodes from any store on a shared instance. The flaw affected multi-tenant deployments where a single CoopCycle installation hosts multiple unrelated worker-owned courier co-operatives, making it a platform-wide cross-tenant data leak. The vulnerability was reported under coordinated disclosure and silently patched in commit a65d9f9e within two days, released as version v5.6.0 shortly after. No official advisory has been published, and a CVE assignment is currently pending; the researcher rated the issue CVSS 6.5 (Medium) due to high confidentiality impact.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Apple Mac Studio sparks debate over local AI infrastructure for personal use

Apple's new Mac Studio, featuring up to 512GB of unified memory and 1.2TB/s memory bandwidth, is being positioned by Apple itself as a machine for running large open-weight AI models locally. A developer writing on DEV Community argues the machine represents a shift from desktop computer to personal AI infrastructure, capable of handling everyday tasks like email classification, summarization, and code generation without sending data to the cloud. The unified memory architecture, shared across CPU and GPU, makes it particularly suited for running local models via frameworks like Apple's open-source MLX. The author contends that most AI workloads — extracting dates, classifying documents, generating embeddings — do not require frontier cloud models, and that a local-first approach keeps sensitive personal data, such as emails and financial records, off third-party servers. Rather than replacing cloud AI entirely, the proposed model uses local processing for routine tasks and escalates only the most complex or ambiguous problems to frontier services like GPT or Claude.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Italian Logistics Firm Ditches Windows for Linux, Cuts Licence Costs to Zero

In early 2026, an IT consultant migrated a five-person logistics and transport company in Bergamo, Italy, from a fully proprietary Windows setup to an open-source Linux environment. The company had been struggling with slow machines, post-update crashes, and rising software licence fees, with no in-house IT expertise. The migration took roughly one week and replaced Windows, Microsoft Office, and third-party antivirus with Kubuntu, LibreOffice, Nextcloud, and other open-source tools, bringing recurring licence costs to zero. The consultant noted that the primary challenge was not technical but psychological, requiring hands-on time with each employee to build comfort with the new software. Six months later, the company has reported no ordinary technical issues, no security incidents, and an estimated recovery of five productive hours per day across the team.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Apple Mac Studio Pitches Itself as Private AI Infrastructure for Desktops

Apple's new Mac Studio offers up to 512GB of unified memory and 1.2TB/s memory bandwidth, with the company explicitly marketing it as a local AI machine capable of running large open-weight models on-device. Unlike traditional setups, Apple Silicon's unified memory architecture allows both the CPU and GPU to share the same memory pool, enabling hundreds of gigabytes of GPU-accessible memory in a quiet personal computer. Apple also highlights the ability to cluster multiple Mac Studio units via Thunderbolt 5 for heavier local workloads, framing the device as personal AI infrastructure rather than a conventional desktop. The author notes that such machines are not positioned to replace cloud AI providers like OpenAI or Anthropic, but rather to serve as a private local intelligence layer that handles routine tasks and keeps sensitive data off external servers. This shift in positioning — from desktop computer to on-premise AI node — is driving renewed interest in hybrid AI architectures that route tasks between local and cloud models based on sensitivity, cost, and complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Like Claude Openly Admit Uncertainty — A Habit Humans Rarely Practice

Claude Code, Anthropic's AI coding assistant, has drawn online attention for routinely flagging its own shortcuts and unverified assumptions with phrases like 'to be honest, I didn't fully test this.' While many users mock these disclosures as quirky machine behavior, a DEV Community essay argues the habit reflects a genuinely valuable professional norm. The author points out that human employees rarely volunteer such admissions unprompted, partly due to natural instincts to avoid embarrassment and present their work favorably. As AI agents take on more real-world tasks, this kind of operational transparency — distinguishing what was verified from what was assumed — could become one of their most practical advantages. The piece concludes that trustworthy colleagues, human or AI, are defined not by infallibility but by surfacing uncertainty while there is still time to act on it.

0 comments Read more at DEV Community