A vulnerability in the American Archive of Public Broadcasting (AAPB) website—an insecure direct object reference (IDOR) flaw—allowed unauthorized users to bypass access controls and download protected and private media files for years, dating back to at least 2021. The exploit, shared via a Tampermonkey script, enabled attackers to manipulate media ID parameters in requests, granting access to restricted content without proper authentication. The flaw was actively exploited by data hoarder communities on Discord, leading to leaks of archival material, including copyrighted and historically significant media (e.g., the Sesame Street 'Wicked Witch of the West' episode). While the vulnerability was patched in 2024, the extent of the leaked content remains unknown. The incident highlights risks posed by archival and fan communities exploiting technical flaws to access sensitive material, even without overtly malicious intent. The AAPB, a nonprofit collaboration between WGBH Educational Foundation and the Library of Congress, emphasized its commitment to security but faced challenges in containing the spread of the exploit and leaked files.