[Contained][Severity: Moderate][API abuse]

Globar: flaw in the Q-Navi ORDER chat API let anyone read and write attachments without logging in

A chat API flaw in the Q-Navi ORDER store app let attachments be read and written without login; 17 outside accesses were found. Store and manager names may have leaked.

Disclosed

2026-11-05

Organizations involved

Leaked or at risk

Unknown

Downtime

Unknown

Outside accesses

What happened

According to Globar K.K., a flaw in the chat API of Q-Navi ORDER let third parties read and write attachments without logging in. Outside access began at 22:33 on 30 October; 17 accesses were found, one of which ended in an error. The company noticed at 20:40 on 1 November and fixed the flaw at 00:11 on 2 November. Store names and store managers’ names may have leaked, but the scope cannot be determined. It has reported to the privacy regulator. [1]