Public Notion Pages Expose Editors’ Profile Photos and Email Addresses

A significant data exposure issue has been brought to light regarding Notion, a highly popular productivity and note-taking application.

This exposure happens without requiring any authentication, cookies, or access tokens, leaving thousands of indexable company wikis and personal pages vulnerable to data scraping.

For organizations that rely on Notion for public-facing documentation, this poses a massive risk of targeted phishing attacks against employees.

Security researchers and users recently discovered that any public Notion page silently exposes the full names, email addresses, and profile photos of everyone who has ever edited it.

How the Data Exposure Works

According to security researchers on X, the vulnerability stems from how Notion handles block permissions on published pages.

When a user creates a page and clicks “Publish to web,” the system inadvertently leaks the Universal Unique Identifiers (UUIDs) of its editors.

The technical breakdown of the exposure is straightforward:

• The public page source code openly displays editor UUIDs within the block permissions data.
• Attackers can scrape these UUIDs and send a single POST request to the /api/v3/syncRecordValuesMain endpoint.
• This specific API endpoint requires absolutely no authentication or tokens to query.
• The server responds with the complete Personally Identifiable Information (PII) of those editors, including full names, email addresses, and profile images.

This privacy flaw is not entirely new. The issue was originally reported to Notion via HackerOne in July 2022.

At the time, the company triaged the report as “informative” and took no immediate action to patch the endpoint.

The controversy reignited recently when researchers like @weezerOSINT and @k1rallik demonstrated the flaw on X, highlighting the severe risks for companies that use public wikis.

In response to the growing community backlash, Notion employee Max Schoening addressed the situation online. He initially claimed that this behavior had been documented and that users had been warned before publishing.

However, researchers quickly debunked this by testing fresh accounts, revealing that the “Publish to web” dialogue offers no warnings about exposing editor emails.

Schoening acknowledged that the current setup is unacceptable and stated that Notion is actively looking into solutions to resolve the data leak.

Planned Fixes and Mitigation Steps

Notion developers are currently exploring two primary fixes to secure the platform. They plan to either strip PII from their public endpoints entirely or implement an email proxy system similar to GitHub’s.

Until an official patch is deployed, users and organizations must take immediate steps to protect their data.

Recommended actions for Notion users include:

• Review all active Notion workspaces to identify which pages are currently published to the web.
• Unpublish any company wikis or sensitive documents that do not strictly require public access.
• Limit the number of editors on pages that must remain public to reduce the exposure footprint.
• Monitor official Notion security advisories for updates on the API patch and new privacy controls.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.