Security researcher claims ClickUp vulnerability is leaking customer data

A security researcher claims to have obtained the email addresses of 959 of the project management platform ClickUp’s customers, including employees from Fortune 500 companies and government agencies. All it reportedly took was sending a single HTTP GET request to exploit a hardcoded API key.

A security researcher who goes by the alias Impulsive (@weezerOSINT) on X complained that ClickUp hasn’t fixed a vulnerability first reported via HackerOne on January 17th, 2025, well over a year ago.

“Found a hardcoded API key in the JavaScript. Copied it. Sent one GET request. Got back 959 email addresses and 3,165 internal feature flags,” the researcher’s post reads.

The researcher claims that one of ClickUp’s production endpoints has a hardcoded Split.io SDK token. Split.io is a feature delivery platform for app features control, rollout, A/B testing, and more.

“No account needed. No session needed at all, just view source and the SDK key is yours,” the researcher claims.

The researcher shared redacted screenshots of the leaking data and claims that some exposed employees are from major companies, including Depot, Fortinet, Autodesk, Tenable, Rakuten, Mayo Clinic, Permira, and Akin Gump.

The leaking emails include government workers and ClickUp’s own employees.

“One request to split.ios API returns 4.5MB of ClickUp’s internal configuration. Every feature flag, every targeting rule, every email in every whitelist. Billing experiments, churn prevention offers, AI pricing tiers, rate limiter IP whitelists, infrastructure routing,” the researcher’s post reads.

The researcher also claims to have directly emailed the company’s CEO and sent direct messages on X, to no avail.

Cybernews found that the hardcoded authorization key was present in the JS bundle for the specified endpoint, but didn’t test whether it was active or functional. We have reached out to ClickUp for – we’ll update this story with its response.

A second critical vulnerability allegedly allows scanning ClickUp’s entire AWS infrastructure using a free account.

“Reported April 8th through HackerOne. Provided port scans, captures with ClickUp's own source IPs, redirect chains to IMDS and Redis, and every non-HTTP protocol confirmed,” the researcher complains.

The researcher noted that ClickUp is certified under numerous cybersecurity compliance standards, such as SOC 2 Type 2, ISO 27001, and PCI DSS, but that these certifications do not prevent major flaws.

“They accept vulnerability reports through HackerOne, pay nothing, and let confirmed issues sit for over a year while customer PII stays exposed,” one of the researcher’s posts reads.

Unlock more exclusive Cybernews content on YouTube.