Strix

A defense technology company exposed user records and military training materials through API endpoints lacking authorization checks. The issue affected Schemata, a virtual training platform used in military settings, and included sensitive information such as user listings and course information. The vulnerability was disclosed by Strix, an open-source security testing project.

A DoD contractor was found to have a multi-tenant authorization vulnerability by Strix, a startup backed by the Department of Defense. The vulnerability is described as a zero-auth vulnerability. The discovery was made public through an article on the Strix blog.