Shot on OnePlus feature was reportedly leaking email id of users online

The API is used to fetch public images uploaded by users but as per a screenshot of it in action, it also displays their sensitive information like email id, upload location and time. The main issue arises due to a ‘gid’ used by the API to identify a user. Every user has a unique gid assigned to them and it can be used by OnePlus’s API to find and/or delete photos uploaded by a particular user. It can also be used to get information on a user like their email id, name and country. Since this id uses a unique number, one can cycle through the numbers to find other users. 

OnePlus was informed about the flaw and the company made some changes to the API to plug the gid leak. “OnePlus takes security seriously, and we investigate all reports we receive,” OnePlus said in a statement. The API is no longer displaying email id of users whose images are publicly posted and currently, the company seems to be working on fixing it as trying to access information is said to be blocked.