Skip to content

Data breach

How the breach happened

Where the published data came from, and why Exoliner's own panel was open to it.

Where the data came from

  1. The panel export (28 September 2026)

    Everything on this site was exported through Exoliner's own mod panel: user accounts, script execution logs, Discord ticket transcripts, moderation records and the panel's own statistics snapshot. The export was taken across several staff-level pulls from more than one source.

  2. Cross-referenced with an earlier leak (June 2025)

    An older Exoliner database export from June 2025 was merged in to fill gaps the panel export left: thousands of account emails, Discord IDs, linked Roblox IDs, email-verified flags and the exact signup dates now shown on the accounts page.

  3. Why it was possible

    An independent security assessment of Exoliner's panel and API found that any staff-rank account could run unaudited, platform-wide operations, with no export limits and no audit alerts. The data below is the panel and API only. The assessment notes the main website carries further issues that are not catalogued here.

Why it was possible

The assessment found no way in for an outsider. The exposure it documents is blast radius: any account holding staff rank could run unaudited write operations against platform-wide configuration, including one that could break every user's executor at once.

1 critical3 high5 medium5 low
Assessed exoliner.wtf and api.serverside.plusDates 3 to 5 October 2026Method bundle reverse-engineering, around 3,700 endpoint probes, nmap, nuclei across 13,742 templates, TLS analysis and an authorization-bypass matrix

What the assessment found

Each finding is described from the assessment of Exoliner's panel and API. It does not cover the main website, which the assessment notes carries further issues.

Critical

1

  • Unaudited global offsets overwrite

    C-1

    The assessment reports that PUT /v1/staff/offsets accepted any staff token with no owner gate and wrote no audit entry. A single request replaced the offsets every user's executor depends on. In testing the total offsets went from 401 to 1 in one call, with no preview, confirmation or approval.

High

3

  • Any support transcript readable by ID

    H-1

    GET /v1/staff/tickets/{id}/transcript is reported to return any ticket by sequential integer with no ownership check, exposing full private conversations including Discord user IDs and attachments.

  • Script deletion reachable by staff

    H-2

    DELETE /v1/scripts/delete is reported to have returned success on a staff token with no ownership check, giving the ability to delete any script by ID with no soft-delete or audit row.

  • No rate limit on full-table enumeration

    H-3

    The assessment reports dumping the entire user table, 13,483 records, in 135 requests over 25 seconds with zero rate-limit responses.

Medium

5

  • No step-up 2FA on privileged writes

    M-1

    Offsets, execute, strike, game toggles, max players, AI review settings, moderation intel and chat mute are all reported to accept a bare bearer token, so a stolen session needs no second factor.

  • 30-day tokens, no enforced kill switch

    M-2

    Tokens are reported to last exactly 30 days with no refresh endpoint, and the authVersion field that would let a single action revoke every session is returned but not enforced server-side.

  • Anti-detection rules writable by any staff

    M-3

    The moderation-intel endpoints that hold Exoliner's anti-detection rules are reported to accept create and delete from any staff account, so those rules could be disabled or corrupted.

  • Deleted private messages exposed to staff

    M-4

    The chat audit endpoint is reported to expose deleted private messages in full to any staff, with the message content, the target user ID and the staff member who deleted it.

  • Staff-tier data exposure

    M-5

    Staff endpoints are reported to leak a revenue estimate, the exact rank distribution, Discord IDs, the full moderation log and place-level latency and server counts.

Low

5

  • Weak frontend content-security-policy

    L-1

    The frontend policy is reported to allow unsafe-inline and unsafe-eval with no nonce, so any cross-site scripting flaw could read a staff session out of local storage.

  • Broken user search

    L-2

    Every search parameter on the users endpoint is reported to be ignored, returning the same unfiltered first page, so staff may be acting on the wrong accounts.

  • Public information disclosure

    L-3

    Unauthenticated health and stats endpoints are reported to leak uptime and live totals, and uniform 404 bodies let the route table be enumerated.

  • Type-confusion server errors

    L-4

    Non-string inputs are reported to cause unhandled 500 errors on several endpoints. Error bodies stay clean, so this reads as reliability rather than disclosure.

  • Duplicate backend hostname

    L-5

    Two hostnames are reported to serve identical routes and authorization from the same process, doubling the attack surface and making a per-host allowlist bypassable through the twin.

Prefer the searchable record? Browse the accounts