TECH Signal 399
tl;dv (Too Lazy; Didn't Validate): 181,874 Meetings Left Wide Open
↗
A security researcher found that tl;dv’s Firestore database lacks tenant isolation, allowing any authenticated user to read all meeting metadata and join live calls.
The exposure lets attackers enumerate and potentially enter sensitive government, university, and corporate meetings, risking data leakage and unauthorized access. Because the database remained open for months despite disclosure, organizations using tl;dv face ongoing confidentiality risks until the flaw is fixed. Engineers must evaluate the trust placed in third-party meeting platforms and consider additional controls such as network-level monitoring or alternative solutions.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The Firestore meetings collection has no tenant isolation, so any authenticated tl;dv user can query every meeting record across all accounts.
Meeting records contain creator emails, conference IDs, provider, recording status, and timestamps; for live calls the conference ID lets an attacker join the ongoing Google Meet, Teams, or Zoom session.
Over 181 k meetings from 84 k users across 35 k domains were exposed, including government calls from 23 countries, university sessions, and corporate meetings from firms such as Mitsui-Soko, HubSpot, and Confluent.
THE CLUSTER