A series of vulnerabilities in UberCENTRAL, a portal Uber started during the summer to help businesses facilitate rides for customers, could have leaked the names, phone numbers, email addresses, and unique ID of all Uber users.
Kevin Roh, a student who actively hunts for bugs in his spare time, discovered the vulnerabilities when he, in September and October, used two techniques to enumerate Uber userUUIDs, or universally unique identifiers. A third issue he discovered revealed the name, phone number and userUUID associated with email addresses used to register for Uber.
