# 14 Vulnerabilities Expose Citizen PII in Indian Government Systems — UPSC Portal Admin Takeover, Delhi Directorate of Education & Scholarship Portal Data Exposure

> Independent researcher Sushant Bhardwaj disclosed 14 vulnerabilities (2 critical, 4 high) across Indian government IT systems — the UPSC civil-service recruitment portal and two Delhi government directories/portals — rooted in missing authentication, broken access control, and poor identity and access management. The flaws exposed birthdays, addresses, guardians' names, schooling/scholarship records, and complete bank account numbers for at least 4,399 named individuals plus a much larger population of the millions of students and job aspirants served by these platforms, and one critical flaw could have let any unauthenticated attacker fully take over the national UPSC portal.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1199
- **ID:** TL-2026-1199
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In April 2026, independent cybersecurity researcher Sushant Bhardwaj found that access controls protecting two Delhi government directories were not enforced at the server level: the directories could be browsed without any authentication, and the files within followed predictable, guessable naming conventions, letting Bhardwaj enumerate private records simply by manipulating the URL path (an insecure direct object reference / predictable-resource pattern). A related information-disclosure flaw in a separate Delhi government IT portal that manages student scholarships exposed the names, guardians' names, schooling and scholarship information, and complete bank account numbers of 4,399 individuals to anyone on the open web, with no authentication barrier.

Bhardwaj went on to identify a dozen additional vulnerabilities in the UPSC (Union Public Service Commission) portal — India's primary civil-service recruitment platform, used by roughly 1.3 million applicants in a single recruitment cycle. The most severe finding was that the administrative interface controlling authentication for the entire UPSC portal was left completely open on the public internet with no access restriction, meaning any unauthenticated attacker could grant themselves administrative access and take over the portal and the applicant data it holds. A second critical-severity issue made the portal vulnerable to automated credential-stuffing/brute-force attacks due to the absence of rate limiting or account-lockout controls. Bhardwaj additionally catalogued missing browser-level security headers (e.g., CSP/HSTS/X-Frame-Options-class hardening gaps), weaknesses in cryptographic handling and OTP (one-time password) implementation, and application/session data inadvertently disclosed inside publicly accessible documents served by the portal.

Taken together, the 14 findings map to a systemic pattern across Indian e-governance platforms: authorization and identity controls implemented inconsistently or only at the client/UI layer, predictable resource naming used in lieu of access checks, and administrative surfaces exposed without network or authentication segmentation. Because these are large, high-value national systems (UPSC serves millions of job aspirants nationally; the Delhi education directorate oversees nearly two million enrolled students), the practical blast radius of any one of these flaws being exploited by a malicious actor — rather than a responsible researcher — would have been mass-scale PII exposure and potential portal-wide account takeover affecting government recruitment and welfare-disbursement operations.

Bhardwaj reported the issues through responsible-disclosure channels to the relevant Indian government bodies. The government engaged professionally with the researcher and patched all 14 issues within two to three weeks of disclosure. No CVE identifiers were assigned to any of the 14 findings, and no evidence has been reported of exploitation by a malicious third party prior to remediation — status is tracked as PATCHED with no confirmed compromise.

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1110 Brute Force
- T1087 Account Discovery
- T1619 Cloud Storage Object Discovery
- T1083 File and Directory Discovery
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal

## Sources

- [Vulnerabilities Expose Private Data in Indian Government Systems](https://www.darkreading.com/vulnerabilities-threats/vulnerabilities-private-data-indian-government-systems)
- [Vulnerabilities Expose Private Data in Indian Government Systems (mirror)](https://news.backbox.org/2026/06/29/vulnerabilities-expose-private-data-in-indian-government-systems/)
- [Directorate of Education, Government of NCT of Delhi](https://edudel.nic.in/)
- [UPSC — Union Public Service Commission official site](https://upsc.gov.in/)
- [I discovered and responsibly disclosed a Broken Access Control vulnerability in a government portal serving 300K+ students](https://radar.offseq.com/threat/i-discovered-and-responsibly-disclosed-a-broken-ac-0d3c1169eaa0e7d7)
- [Exposing Critical Vulnerabilities in CBSE's On-Screen Marking Portal: From Authentication Bypass to Full Account Takeover](https://ni5arga.com/blog/posts/hacking-cbse/)
- [Safeguarding Personally Identifiable Information](https://www.drishtiias.com/daily-updates/daily-news-analysis/safeguarding-personally-identifiable-information)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1199