FIA Driver Categorisation flaw exposed access to 7,000 drivers data

Three security researchers discovered in June that a vulnerability in the FIA’s Driver Categorisation website allowed them to obtain administrator-level access to personal records for nearly 7,000 licensed drivers, including documents tied to four-time world champion Max Verstappen, the researchers and the governing body said. The flaw was reported to the FIA in June and disclosed publicly this week in a blog post by one of the researchers, prompting the governing body to take the portal offline and secure the system.

The researchers said they gained access after registering an ordinary user account and exploiting weaknesses in the site’s permission controls that elevated their privileges. With those rights, they were able to view passports, licenses, curriculum vitae and other personally identifiable information for any driver in the categorisation system. One of the researchers wrote, "We stopped testing after seeing that it was possible to access Max Verstappen's passport, résumé, license, password hash, and PII." The team said they did not download or retain sensitive files, deleted test data and immediately informed the FIA.

The FIA confirmed it became aware of a cyber...