ClickUp Security Flaw Exposes 959 Emails Linked to Major Fortune 500 Firms

Gbhackers •Divya • April 28, 2026

A major security flaw in the popular productivity platform ClickUp has exposed sensitive data, including 959 email addresses tied to Fortune 500 companies and government agencies. The primary vulnerability stems from a hardcoded Split.io SDK token left inside ClickUp’s production JavaScript bundle. This script loads automatically whenever a user visits the platform’s content delivery network. […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClickUp API Key Vulnerability Exposes 959 Emails from Fortune 500 Firms A security vulnerability in ClickUp has led to the exposure of 959 email addresses associated with major Fortune 500 companies and government agencies. The issue arises from a hardcoded Split.io SDK token in ClickUp’s production JavaScript bundle, which is automatically loaded when users access the platform. This vulnerability was first reported in January 2025 and has not been addressed as of April 2026. Affected organizations include Fortinet, Depot, Tenable, Mayo Clinic, and various U.S. state government employees. The exposed emails could lead to phishing attacks and other malicious activities. The vulnerability remains unpatched, raising significant security concerns. Security professionals are urged to monitor for potential misuse of the exposed data. The incident highlights the risks associated with hardcoded credentials in production environments. 3 sources 66

Extracted Entities

ClickUp Security Flaw Exposes 959 Emails Linked to Major Fortune 500 Firms

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CWE Weaknesses (2)

Domains (1)

Industries (1)