Photo Booth Maker's Website Exposes Thousands of Images and Videos Due to Insecure Access Control

**Photo Booth Vendor’s Security Flaw Exposed Thousands of Private Images and Videos** A security researcher, known as Zeacer, uncovered a critical vulnerability in a photo booth vendor’s website that left thousands of images and videos—including intimate moments and drunken party snapshots—publicly accessible without authentication. The flaw stemmed from insecure direct object references, where media files were served via predictable URLs, allowing attackers to enumerate and download entire galleries using simple scripts. The company had recently reduced file retention from two to three weeks to just 24 hours, limiting the volume of exposed content at any given time. However, this change did not prevent attackers from scraping daily uploads. At one point, over 1,000 images from a Melbourne-based photo booth service were visible, highlighting the scale of the risk. The incident underscores the dangers of broken access control, ranked by OWASP as the top web application security risk. Event photo booths often capture highly personal moments—weddings, corporate events, and private gatherings—where sensitive details like home addresses, children’s faces, or organizational affiliations may be inadvertently exposed. Even with short retention periods, scraped data remains permanently accessible to attackers. The financial and reputational consequences of such breaches can be severe. IBM’s *Cost of a Data Breach Report* estimates global breach costs in the multi-millions, while consumer-facing brands built on "shareable moments" face lasting reputational harm. The flaw likely resulted from common shortcuts in event-tech development, such as public object storage, client-side-only checks, and predictable URL patterns—issues that could have been mitigated with server-side protections like signed URLs, randomized IDs, and rate limiting. Regulatory risks also loom large. Under Australia’s privacy laws, businesses must proactively secure data and disclose breaches, while GDPR in the EU and UK imposes fines of up to 4% of global turnover for serious violations. The vendor’s role—as either a data processor or controller—determines specific compliance obligations, but minimizing retention and enforcing strict access controls are baseline requirements. Customers who used affected photo booths in the past month should assume potential exposure and request gallery deletions from vendors. Event organizers are advised to demand transparency from suppliers, including details on file retention, link security, and third-party audits like SOC 2 or ISO 27001. Contracts should explicitly address data processing terms and breach notification responsibilities. The incident reflects a broader trend in event tech, where rapid growth often outpaces security hardening. As web app vulnerabilities remain a leading cause of data breaches, basic safeguards—such as private-by-default storage and continuous logging—can prevent such exposures without requiring complex solutions. While the vendor’s retention reduction limits immediate risk, it does not replace proper authentication and authorization, leaving galleries vulnerable to persistent scraping.