A confidentiality failure happens when information is exposed to people or systems that should not be able to access it. In security terms, it is a break in the property that keeps data secret. The leak may be direct, such as an access-control bug, or indirect, such as metadata, logs, or forwarding rules revealing sensitive identifiers.
This matters because even partial disclosure can help attackers correlate accounts, target phishing, or deanonymize users. In email privacy systems, for example, a relay alias is supposed to hide the real inbox behind a masked address. If the boundary between the alias and the destination is flawed, the protected address can be revealed. Defenders look for this class of problem by reviewing trust boundaries, testing account-binding logic, and treating supposedly disposable identifiers as sensitive data.