14 Vulnerabilities Expose Citizen PII in Indian Government Systems — UPSC Portal Admin Takeover, Delhi Directorate of Education & Scholarship Portal Data Exposure
14 Vulnerabilities Expose Citizen PII in Indian Government (TL-2026-1199) is a critical-severity software vulnerability, first published 2026-07-10. It has no confirmed attribution, affects Union Public Service Commission (Government of India) UPSC Online, maps to 16 MITRE ATT&CK techniques (T1005, T1068, T1078), and is covered by 9 detection rules and 15 indicators of compromise.
Key facts for TL-2026-1199
- Threat ID
- TL-2026-1199
- Severity
- CRITICAL
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- 2026-07-10
- Last reviewed
- 2026-07-10
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, education
- Target regions
- india, South Asia, Delhi NCT
- Detection rules
- 9
- Indicators of compromise
- 15
Independent researcher Sushant Bhardwaj disclosed 14 vulnerabilities (2 critical, 4 high) across Indian government IT systems — the UPSC civil-service recruitment portal and two Delhi government directories/portals — rooted in missing authentication, broken access control, and poor identity and access management. The flaws exposed birthdays, addresses, guardians' names, schooling/scholarship records, and complete bank account numbers for at least 4,399 named individuals plus a much larger population of the millions of students and job aspirants served by these platforms, and one critical flaw could have let any unauthenticated attacker fully take over the national UPSC portal.
How 14 Vulnerabilities Expose Citizen PII in Indian Government works
In April 2026, independent cybersecurity researcher Sushant Bhardwaj found that access controls protecting two Delhi government directories were not enforced at the server level: the directories could be browsed without any authentication, and the files within followed predictable, guessable naming conventions, letting Bhardwaj enumerate private records simply by manipulating the URL path (an insecure direct object reference / predictable-resource pattern). A related information-disclosure flaw in a separate Delhi government IT portal that manages student scholarships exposed the names, guardians' names, schooling and scholarship information, and complete bank account numbers of 4,399 individuals to anyone on the open web, with no authentication barrier.
Bhardwaj went on to identify a dozen additional vulnerabilities in the UPSC (Union Public Service Commission) portal — India's primary civil-service recruitment platform, used by roughly 1.3 million applicants in a single recruitment cycle. The most severe finding was that the administrative interface controlling authentication for the entire UPSC portal was left completely open on the public internet with no access restriction, meaning any unauthenticated attacker could grant themselves administrative access and take over the portal and the applicant data it holds. A second critical-severity issue made the portal vulnerable to automated credential-stuffing/brute-force attacks due to the absence of rate limiting or account-lockout controls. Bhardwaj additionally catalogued missing browser-level security headers (e.g., CSP/HSTS/X-Frame-Options-class hardening gaps), weaknesses in cryptographic handling and OTP (one-time password) implementation, and application/session data inadvertently disclosed inside publicly accessible documents served by the portal.
Taken together, the 14 findings map to a systemic pattern across Indian e-governance platforms: authorization and identity controls implemented inconsistently or only at the client/UI layer, predictable resource naming used in lieu of access checks, and administrative surfaces exposed without network or authentication segmentation. Because these are large, high-value national systems (UPSC serves millions of job aspirants nationally; the Delhi education directorate oversees nearly two million enrolled students), the practical blast radius of any one of these flaws being exploited by a malicious actor — rather than a responsible researcher — would have been mass-scale PII exposure and potential portal-wide account takeover affecting government recruitment and welfare-disbursement operations.
Bhardwaj reported the issues through responsible-disclosure channels to the relevant Indian government bodies. The government engaged professionally with the researcher and patched all 14 issues within two to three weeks of disclosure. No CVE identifiers were assigned to any of the 14 findings, and no evidence has been reported of exploitation by a malicious third party prior to remediation — status is tracked as PATCHED with no confirmed compromise.
MITRE ATT&CK techniques used in TL-2026-1199
Collection
T1005 Data from Local System; T1213 Data from Information Repositories
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1078 Valid Accounts
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1083 File and Directory Discovery; T1087 Account Discovery; T1619 Cloud Storage Object Discovery
Credential Access
Persistence
Defense Evasion
T1211 Exploitation for Stealth
Impact
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
T1595 Active Scanning; T1596 Search Open Technical Databases
Affected products and versions in 14 Vulnerabilities Expose Citizen PII in Indian Government
- Union Public Service Commission (Government of India) — UPSC Online Recruitment/Applicant Portal
Vulnerable versions: production instance, pre-June 2026 patch
Fixed in: patched production instance, post-disclosure (June 2026) - Directorate of Education, Government of NCT of Delhi — Delhi Government Education Directory (student records)
Vulnerable versions: production instance, pre-June 2026 patch
Fixed in: patched production instance, post-disclosure (June 2026) - Government of NCT of Delhi — Delhi Government Scholarship Portal
Vulnerable versions: production instance, pre-June 2026 patch
Fixed in: patched production instance, post-disclosure (June 2026)
Remediation for 14 Vulnerabilities Expose Citizen PII in Indian Government
Patches
- Delhi government directory access controls remediated to enforce server-side authentication (patched within 2-3 weeks of disclosure)
- Delhi scholarship portal information-disclosure vulnerability remediated; predictable file paths reworked
- UPSC administrative/authentication interface access restricted and secured against unauthenticated takeover
- UPSC brute-force/credential-attack exposure mitigated with authentication hardening
- Missing security headers, OTP/cryptographic weaknesses, and public-document data exposure on UPSC portal addressed
Immediate actions
- Enforce server-side authorization checks on every directory and document endpoint; never rely solely on client-side/UI-layer access control
- Remove predictable, sequential, or guessable file/record naming from public-facing directories; use non-enumerable identifiers (UUIDs) with authorization checks
- Restrict administrative interfaces to internal network segments or VPN/zero-trust access; never expose admin/auth-management consoles to the open internet
- Implement rate limiting, account lockout, and CAPTCHA/MFA on all authentication endpoints to prevent automated credential attacks
- Audit all publicly served documents (PDFs, exports) for embedded PII or session/application data before publication
Workarounds
- Pending remediation, restrict administrative interfaces via firewall/allowlisting to known internal IP ranges
- Disable or gate public directory browsing on affected government portals until server-side authorization is verified
Longer-term hardening
- Adopt a formal identity and access management (IAM) framework across all e-governance platforms with centralized policy enforcement
- Establish a standing vulnerability disclosure program (VDP) with CERT-In coordination for all national and state government portals
- Mandate periodic third-party penetration testing and access-control audits for portals handling citizen PII and financial data
- Deploy browser security headers (CSP, HSTS, X-Frame-Options, X-Content-Type-Options) baseline across all government web properties
- Modernize OTP/cryptographic implementations to current standards (TOTP with strong entropy, vetted crypto libraries)
Weaknesses (CWE) in 14 Vulnerabilities Expose Citizen PII in Indian Government
CWE-284, CWE-287, CWE-306, CWE-639, CWE-538, CWE-307, CWE-693, CWE-798, CWE-522
Timeline of 14 Vulnerabilities Expose Citizen PII in Indian Government
- Independent researcher Sushant Bhardwaj discovers that access controls on two Delhi government directories are not enforced server-side, allowing unauthenticated browsing and enumeration of private records via predictable file naming.
- Bhardwaj identifies a separate information-disclosure vulnerability in the Delhi government scholarship portal, exposing names, guardians' names, schooling/scholarship data, and bank account numbers for 4,399 individuals.
- Bhardwaj begins probing the UPSC (Union Public Service Commission) portal, ultimately identifying a dozen distinct vulnerabilities rooted in poor identity and access management.
- Critical finding: UPSC's administrative interface controlling portal authentication is discovered fully exposed to the open internet, enabling unauthenticated attacker self-provisioned admin takeover.
- Second critical finding: UPSC portal found vulnerable to automated credential/brute-force attacks due to missing rate limiting and account lockout; additional issues cataloged (missing security headers, weak OTP/cryptography, PII in public documents).
- Bhardwaj responsibly discloses the full set of 14 vulnerabilities to the relevant Indian government bodies / CERT-In.
- Government agencies begin remediation work across the Delhi directories, scholarship portal, and UPSC portal following disclosure.
- All 14 vulnerabilities patched by the Indian government within two to three weeks of disclosure; status moves to PATCHED with no confirmed malicious exploitation.
- DarkReading publishes 'Vulnerabilities Expose Private Data in Indian Government Systems,' detailing the disclosure and remediation.
Sources cited for 14 Vulnerabilities Expose Citizen PII in Indian Government
- Vulnerabilities Expose Private Data in Indian Government Systems
- Vulnerabilities Expose Private Data in Indian Government Systems (mirror)
- Directorate of Education, Government of NCT of Delhi
- UPSC — Union Public Service Commission official site
- I discovered and responsibly disclosed a Broken Access Control vulnerability in a government portal serving 300K+ students
- Exposing Critical Vulnerabilities in CBSE's On-Screen Marking Portal: From Authentication Bypass to Full Account Takeover
- Safeguarding Personally Identifiable Information
Threats related to 14 Vulnerabilities Expose Citizen PII in Indian Government
- SolarWinds Serv-U 2026.3 Patches 16 Vulnerabilities (CVE-2026-28302 to CVE-2026-28321) Including Root RCE, IDOR-Chained Privilege Escalation, and Broken Access Control
- ShutterGap: Ephemeral Public Exposure of AWS RDS/DocumentDB Snapshots, AMIs & SSM Documents Evades CSPM/CNAPP Scan Cycles
- FIFA World Cup 2026 Broadcast API Broken Access Control (Missing Server-Side Authorization) Allowed Live TV Stream Takeover
- Pickle in the Middle: Vertex AI Model Upload Hijacking via GCS Bucket Squatting Enables Cross-Tenant RCE (google-cloud-aiplatform v1.139.0/v1.140.0)
- Multiple JetBrains Product Vulnerabilities: Account Takeover, Privilege Escalation, and RCE Across Hub, YouTrack, IntelliJ IDEA, Kotlin, GoLand, and TeamCity
- CosmosEscape: Gremlin API Sandbox Escape Exposed Platform-Wide Key for Every Azure Cosmos DB Database
Detection coverage for TL-2026-1199
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1199 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.