Unauthorized data exposure is a confidentiality failure where sensitive information becomes readable by a user, service, or attacker that should not have access. The flaw is often not the data itself, but the control around it: a broken authorization check, a misconfigured export endpoint, an unsafe API response, or overly broad permissions on backups, logs, or cached files.
In real attacks, this can leak profile details, private messages, tokens, moderator tools, or internal documents. Even without code execution, exposed data can support account takeover, phishing, privilege escalation, or further intrusion. Defenders reduce the risk by enforcing server-side access checks, limiting what each request returns, filtering sensitive fields, and testing for broken object references and unintended disclosure paths. Encryption helps protect stored data, but it does not replace correct authorization.