This vulnerability in Hiperdino's REST API v1.0 involves inadequate access control on the 'customer/check' endpoint. An attacker possessing a static bearer token can submit a telephone number or email address and, if it matches a registered customer, retrieve that customer's email and telephone number. The API does not require additional authentication beyond the static token, lacks rate limiting, and does not implement generic error handling, facilitating user contact detail enumeration. The issue is classified under CWE-284 (Improper Access Control) and has a CVSS 4.0 base score of 9.2, indicating critical severity.

Successful exploitation allows a remote attacker with access to a valid static bearer token to enumerate and disclose registered customers' contact details (email addresses and telephone numbers). This constitutes a significant information disclosure risk. There is no indication of privilege escalation, denial of service, or code execution impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the static bearer token, monitor its usage, and consider implementing additional access controls or rate limiting on the affected endpoint to reduce exposure.