Peloton users could set their accounts to "private." The Peloton app respected this setting and hid personal details from other users. But the API did not.
Security researcher Jan Masters (Pen Test Partners) discovered that calling the Peloton API directly returned the full user profile object — including fields the privacy setting was supposed to restrict: age, gender, city, weight, birthday, and full workout statistics.
The privacy setting controlled what the frontend displayed. It did not control what the API returned. Any authenticated Peloton user could request any other user's profile endpoint and receive the complete unsanitized object.
4+ million users had their private data exposed. Peloton was notified in January 2021. Their first fix — adding authentication to the endpoint — didn't solve the property-level exposure. The full fix took over 90 days.
Peloton's initial response was to add authentication to the endpoint (fixing a BOLA issue). But authenticated users could still retrieve the full profile object of any other user, including all the "private" fields. Property-level access control was still missing.