Most of current user profile related pages contain user-id in URL section, e.g. my edit profile page:


If you try to open it you will see a 404 stub (I hope you're not a SO stuff):


But it's not true for Preferences and Flair pages. For these pages it seems at a first sight that you can access another user's personal data, but I hope there are no security issues, just UI elements not linked to any data (you need to be logged in to see these pages). For instance here are Sonic's "preferences":

Sonic the K-Day Hedgehog

and Glorfindel's Flair:


Anyway I suggest hiding such weird pages and displaying the same 404 page as for other profile related tabs.

Bonus panel: for SO sites where theme support is enabled, changing the theme for not-yours page leads to displaying an empty popup from the top of the page:

Not yours theme

  • 8
    Flair is public and can be accessed anyway, always was. Preferences however is a different case, and clear breach of privacy. Nov 3 '20 at 19:04
  • @Shadow10YearsWizard It's weird if you want to emplace another user Flair to your site (ofcourse if you don't write an article about top SE users). Nov 3 '20 at 19:08
  • 2
    I've contacted SE as per the instructions for reporting serious security issues with a link to this issue report. Nov 3 '20 at 19:12
  • Yeah...doesn't that mean you can download their activity data as well? If so, then quick fix please!
    – Ollie
    Nov 3 '20 at 22:36
  • 6
    We're looking into it right now
    – Yaakov Ellis StaffMod
    Nov 3 '20 at 22:56
  • 10
    @Ollie The download route always looks at the currently logged in user's info, so no downloads would've been exposed this way.
    – Adam Lear StaffMod
    Nov 4 '20 at 1:29

Thanks for reporting! This has been fixed in rev 2020.11.4.37941.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .