{"@context":"https://schema.org","@type":"NewsArticle","generatedAt":"2026-08-10T19:40:29.648Z","headline":"tl；dv 逾18.1万段AI会议录音被公开暴露，可实时闯入他人通话","description":"AI会议记录平台tl；dv的Firestore数据库因缺乏租户隔离，任何已认证用户可查询全部18.1万段会议记录，涉及84，312名用户、35，003个域名，含23国政府及多所高校会议。处于录制状态的约1，000场会议会暴露可加入的会议ID，研究者借此闯入马来西亚教育部及美国某大学创业团队的实时通话。该漏洞自2026年1月报告后6个月仍未修复，另有超1，000段会议内容为公开状态。 🔗 阅读原文 via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","url":"https://www.aioga.com/news/cmsnbc14r0aezron58wsytu43/","mainEntityOfPage":"https://www.aioga.com/news/cmsnbc14r0aezron58wsytu43/","datePublished":"2026-08-10T14:03:26.000Z","dateModified":"2026-08-10T14:03:26.000Z","inLanguage":"zh-CN","publisher":{"@type":"NewsMediaOrganization","name":"Aioga","url":"https://www.aioga.com"},"citation":["https://bobdahacker.com/blog/tldv-hack","https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43"],"canonicalUrl":"https://www.aioga.com/news/cmsnbc14r0aezron58wsytu43/","directAnswer":{"@type":"Answer","text":"研究者称，tl；dv 的 Firestore 会议集合缺乏租户隔离，已认证用户可跨账户查询约18.1万段会议记录。部分正在录制的记录还会暴露可加入的会议ID，形成未经邀请进入实时通话的风险。","url":"https://www.aioga.com/news/cmsnbc14r0aezron58wsytu43/","dateCreated":"2026-08-10T14:03:26.000Z","author":{"@type":"Organization","@id":"https://www.aioga.com/authors/aioga-editorial/#editorial-team","name":"Aioga Editorial Team","url":"https://www.aioga.com/authors/aioga-editorial/"}},"evidence":[{"@type":"CreativeWork","name":"bobdahacker.com source article","url":"https://bobdahacker.com/blog/tldv-hack","datePublished":"2026-08-10T14:03:26.000Z","provider":{"@type":"Organization","name":"bobdahacker.com","url":"https://bobdahacker.com/blog/tldv-hack"}},{"@type":"CreativeWork","name":"AIHot archive record","url":"https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","datePublished":"2026-08-10T14:03:26.000Z","provider":{"@type":"Organization","name":"AIHot","url":"https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43"}}],"aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","originalPublisher":{"name":"bobdahacker.com","url":"https://bobdahacker.com/blog/tldv-hack"},"geoDeepAnswer":null,"article":{"id":"cmsnbc14r0aezron58wsytu43","slug":"cmsnbc14r0aezron58wsytu43","url":"https://www.aioga.com/news/cmsnbc14r0aezron58wsytu43/","title":"tl；dv 逾18.1万段AI会议录音被公开暴露，可实时闯入他人通话","title_en":"","summary":"AI会议记录平台tl；dv的Firestore数据库因缺乏租户隔离，任何已认证用户可查询全部18.1万段会议记录，涉及84，312名用户、35，003个域名，含23国政府及多所高校会议。处于录制状态的约1，000场会议会暴露可加入的会议ID，研究者借此闯入马来西亚教育部及美国某大学创业团队的实时通话。该漏洞自2026年1月报告后6个月仍未修复，另有超1，000段会议内容为公开状态。 🔗 阅读原文 via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","source":"Hacker News 热门（buzzing.cc 中文翻译）","sourceUrl":"https://bobdahacker.com/blog/tldv-hack","aiHotUrl":"https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","publishedAt":"2026-08-10T14:03:26.000Z","category":"行业动态","score":72,"selected":true,"articleBody":["I reported this on January 28th, 2026. It is now July 2026. Six months later. The Firestore database is still wide open. The CTO never responded. I guess my emails were too long and they didn't view them.","tl;dv (Too Long; Didn't View) is an AI meeting recording platform. It drops a bot into your Google Meet, Zoom, or Teams call, records everything, transcribes it, and generates summaries with AI. Over 2 million users. Backed by investors. Endorsed by half of LinkedIn's sales influencer community.","They store your sales calls, job interviews, performance reviews, internal strategy sessions. The kind of content where someone says \"this call is being recorded\" and everyone nervously laughs and then shares trade secrets for 45 minutes.","The meetings collection has no tenant isolation. Any authenticated tl;dv user can query every meeting across every account on the platform. Each meeting record hands you the creator's email address, the conference ID (which is a joinable Google Meet or Teams room), the provider, the recording status, and timestamps.","For meetings in recording status, that conference ID is a live, active call. You can watch the collection in real time, see a meeting start recording, grab the ID, and walk into someone's call uninvited. At any given time there are roughly 1,000 meetings with status: recording sitting in the collection. A thousand live calls with exposed conference IDs. An attacker with a bot could join all of them simultaneously.","Grabbed a conference ID from Firestore and joined a live Google Meet belonging to the Malaysian Ministry of Education . A lady was presenting to over 157 participants. The tl;dv bot was already in the participant list. I was in the same call. Nobody invited me. The Firestore database did.","I also joined a call where students from a major US university were building a startup app. 21 people in the call. They were screen-sharing their entire project, discussing prototypes, and, I kid you not, talking about how they needed to add client-side validation for .edu email addresses. They were also setting up Supabase live on screen, and all I could think was \"please set up RLS policies\" because most people don't, and then you end up like tl;dv.","I wanted to say something so badly. \"Hey, you might want server-side validation too.\" But this was a proof of concept, not a consultation.","I queried the Firestore meetings collection and saw there were 181,874 meeting records belonging to 84,312 unique users across 35,003 email domains .","Government meetings from 23 countries : Brazil, Colombia, Peru, Ukraine, El Salvador, the Philippines, Chile, Indonesia, Mexico, the United States, Qatar, Malaysia, Uzbekistan, Sri Lanka, Haiti, South Africa, Jamaica, Honduras, Argentina, Thailand, Japan, Israel, and Belize. All .gov domains. Government employees recording calls on a platform that lets any free-tier user enumerate the whole thing.","University meetings from Berkeley, the University of Tokyo, De La Salle, Universidad Nacional de Colombia. Dozens of .edu and .ac domains.","Corporate meetings from all 35,000 remaining domains. Mitsui-Soko (484 meetings across four regional offices), Mitsui Fudosan, HubSpot, Confluent, Mekari, AnyMind Group. Every company that ever used tl;dv had their meeting metadata in the same unprotected collection.","Peak month was July 2025 with 43,209 meetings . Busiest time slot: Wednesday at 2pm UTC , 7,804 meetings. Hump-day standup hour.","I wanted to know how much actual content was accessible too, by default meetings are private (Meaning you cant watch the video or see the transcript), so I scraped 27,334 meeting IDs and checked which ones were public. Over 1,000 were. 715 invitee emails exposed across 228 domains .","Highlights: a Brazilian government conservation meeting (PACTO Mata Atlântica) with participants from WWF, The Nature Conservancy, Conservation International, WRI, and the São Paulo state government. Meetings from Ukraine's Ministry of Digital Transformation. A HubSpot sales call. Sessions involving Universidad Nacional de Colombia and Chile's Cámara Verde.","tl;dv names their microservices after pasta. A subdomain scan reveals cappellini , carbonara , fusilli , pasta , penne , puttanesca-v0 , and ravioli , all under tldv.io. An entire Italian restaurant worth of Express servers.","While exploring their subdomains I found https://worldcup.tldv.io：https://worldcup.tldv.io . A FIFA World Cup 2026 vibecoded prediction game built on Base44 for tl;dv employees. It's called \"World Cup Pick'em\" and their internal squad is named \"Too Long; Didn't Score.\" Cute.","Raphael Allstadt, my disclosure contact who gave vague reassurances and then went quiet, came in 2nd place with 298 points. His personal Gmail was also in the API response. Player #5 on the global leaderboard is \"Super Duper CEO.\" I'll let you guess who that is.","The Prediction and Fixture entities are also wide open. A company that records millions of people's meetings vibecoded an internal fun app that leaks their own employee directory. The irony is al dente.","On January 28th I messaged Raphael Allstadt on LinkedIn and told him I'd found a huge vulnerability that leaks user data. He responded within minutes: \"thank you! can you report it to our CTO and we will look at it immediately?\" I sent the email. He said \"thank you!\" I asked about a reward. \"My CTO will come back to you,\" he said.","January 29th: \"your cto hasnt reached out yet btw and its not fixed.\" January 30th, Raphael: \"I am sure the team is reviewing it very very soon ❤️\" February 14th: \"havent got an email and the vulnerability stilll works.\" Raphael: \"He'll come back ☺️\" I told him to maybe fix the vulnerability and not leave customers exposed. February 19th: \"We're on it. It needs some time, but rest assured we're following through. For further communication, i'll recommend reaching out to our CTO.\"","The CTO who never responded. That CTO.","March 6th: \"still not fixed.\" Seen by Raphael at 5:42 PM. No reply.","July 22nd: \"still not fixed...\" No reply.","Your platform records people's most sensitive conversations. Job interviews. Sales negotiations. Government briefings. Your users trusted you with content they explicitly consented to record.","Fix the Firestore tenant isolation. Firestore security rules exist for this. You already do it correctly for every other collection (users, chats, transcripts, clips, recordings, videos, notes, teams, organizations all return 403). You just forgot meetings.","Put auth on the World Cup app or take it down. Your employee directory is one GET request away.","Respond to security researchers. Especially when they're telling you that every meeting on your platform is queryable by anyone with a free account.","So long and thanks for all the pasta :3"],"articleImages":[{"sourceUrl":"https://bobdahacker.com/static/images/blogs/tldv/firebase.png","alt":"A call thats being recorded","afterParagraph":4,"url":"/media/articles/cmsnbc14r0aezron58wsytu43/4c02195986bacceb.png"},{"sourceUrl":"https://bobdahacker.com/static/images/blogs/tldv/meeting1.png","alt":"Call 1","afterParagraph":5,"url":"/media/articles/cmsnbc14r0aezron58wsytu43/25a1fe8cbb182ae2.png"},{"sourceUrl":"https://bobdahacker.com/static/images/blogs/tldv/meeting2.png","alt":"Call 1","afterParagraph":7,"url":"/media/articles/cmsnbc14r0aezron58wsytu43/788a100a215a35ce.png"},{"sourceUrl":"https://bobdahacker.com/static/images/blogs/tldv/worldcup_slop.png","alt":"A vibecoded world cup slop app","afterParagraph":18,"url":"/media/articles/cmsnbc14r0aezron58wsytu43/80db1f9248da7287.png"}],"mediaStatus":"ok","articleBodyZh":["我在2026年1月28日报告了这个问题。现在是2026年7月，六个月过去了。Firestore 数据库仍然完全开放。首席技术官从未回应。我猜我的邮件太长了，他们没看。","tl;dv（太长；没看）是一个AI会议记录平台。它会在你的 Google Meet、Zoom 或 Teams 通话中放入一个机器人，记录所有内容，进行转录，并用AI生成总结。超过200万用户。由投资者支持。得到了LinkedIn一半销售影响者社区的认可。","他们存储你的销售电话、求职面试、绩效评估、内部策略会议。这类内容通常有人会说“这个电话正在被记录”，大家紧张地笑，然后分享45分钟的商业机密。","会议集合没有租户隔离。任何经过身份验证的 tl;dv 用户都可以查询平台上每个账户的所有会议。每条会议记录会提供创建者的电子邮件地址、会议 ID（可加入的 Google Meet 或 Teams 房间）、提供者、录音状态和时间戳。","对于处于录音状态的会议，该会议ID是一个实时、活跃的通话。你可以实时查看集合，看到会议开始录音，获取ID，然后未被邀请地加入某人的通话。目前集合中大约有1000个会议处于录音状态。一千个具有暴露会议ID的实时通话。攻击者带着机器人可以同时加入所有这些通话。","从 Firestore 获取了一个会议 ID，并加入了马来西亚教育部的一个实时 Google Meet。一个女士在向157名以上的参与者进行演示。tl;dv 机器人已经在参与者列表里。我也在同一个通话中。没有人邀请我。是 Firestore 数据库邀请的。","我还加入了一个通话，美国一所知名大学的学生正在开发一个初创应用。通话中有21人。他们共享整个项目的屏幕，讨论原型，我不是开玩笑，他们还在讨论如何为 .edu 邮箱地址添加客户端验证。他们还在屏幕上设置 Supabase live，我能想到的只是“请设置 RLS 策略”，因为大多数人不设置，然后你就会像 tl;dv 那样。","我非常想说点什么。“嘿，你可能也需要服务器端验证。”但这是一个概念验证，而不是咨询。","我查询了 Firestore 的会议集合，发现有 181,874 条会议记录，属于 84,312 个独立用户，涵盖 35,003 个电子邮件域名。","来自 23 个国家的政府会议：巴西、哥伦比亚、秘鲁、乌克兰、萨尔瓦多、菲律宾、智利、印度尼西亚、墨西哥、美国、卡塔尔、马来西亚、乌兹别克斯坦、斯里兰卡、海地、南非、牙买加、洪都拉斯、阿根廷、泰国、日本、以色列和伯利兹。所有都是 .gov 域名。政府员工在一个允许任何免费用户枚举所有内容的平台上记录通话。","来自伯克利大学、东京大学、德拉萨尔大学、哥伦比亚国立大学的大学会议。数十个 .edu 和 .ac 域名。","来自其余 35,000 个域名的企业会议。三井仓库（四个区域办事处共 484 场会议）、三井不动产、HubSpot、Confluent、Mekari、AnyMind Group。曾使用过 tl;dv 的每家公司，其会议元数据都存储在同一个未受保护的集合中。","最高峰月份是 2025 年 7 月，共有 43,209 场会议。最繁忙的时间段：UTC 星期三下午 2 点，共有 7,804 场会议。周中例会时间。","我也想知道实际可访问的内容有多少，默认情况下会议是私密的（意味着你无法观看视频或查看文字记录），所以我抓取了 27,334 个会议 ID 并检查哪些是公开的。有超过 1,000 个是公开的。715 个受邀者邮箱暴露在 228 个域名中。","亮点：一场巴西政府的保护会议（PACTO Mata Atlântica），参与者包括 WWF、自然保护协会、国际保护组织、世界资源研究所，以及圣保罗州政府。来自乌克兰数字化转型部的会议。一场 HubSpot 销售电话。涉及哥伦比亚国立大学和智利绿色议会的会议。","tl;dv 以意大利面命名其微服务。子域扫描显示 cappellini、carbonara、fusilli、pasta、penne、puttanesca-v0 和 ravioli，全部在 tldv.io 下。整整一家意大利餐厅数量的 Express 服务器。","在探索他们的子域名时，我发现了 https://worldcup.tldv.io：https://worldcup.tldv.io。这是一个基于 Base44 为 tl;dv 员工创建的 FIFA 2026 世界杯 vibecoded 预测游戏。它叫做“World Cup Pick'em”，他们的内部队伍名为“Too Long; Didn't Score”。很可爱。","Raphael Allstadt，我的披露联系人，他给了模糊的保证然后就沉默了，以 298 分获得第二名。他的个人 Gmail 也出现在 API 响应中。全球排行榜上的第 5 名玩家是“Super Duper CEO”。我就让你们自己猜那是谁。","Prediction 和 Fixture 实体也完全开放。一家公司记录了数百万人的会议，却 vibecoded 了一个内部娱乐应用，泄露了自己的员工目录。讽刺得很。","1 月 28 日，我在 LinkedIn 上给 Raphael Allstadt 发消息，告诉他我发现了一个泄露用户数据的重大漏洞。他在几分钟内回复：“谢谢！你可以向我们的 CTO 举报，我们会立即查看吗？”我发了邮件。他说“谢谢！”我询问奖励事宜。他说：“我的 CTO 会回复你。”","1 月 29 日：“顺便说一句，你的 CTO 还没联系我，而且问题还没修复。” 1 月 30 日，Raphael：“我相信团队很快会审核 ❤️” 2 月 14 日：“还没收到邮件，漏洞仍然存在。” Raphael：“他会回复的 ☺️” 我告诉他也许应该修复漏洞，而不是让客户暴露。 2 月 19 日：“我们正在处理。需要一些时间，但请放心，我们会跟进。进一步沟通的话，我建议联系 CTO。”","那个从未回复的首席技术官。就是那个首席技术官。","3 月 6 日：“仍未修复。” Raphael 于下午 5:42 已阅读。无回复。","7月22日：“仍然没有修好……”没有回复。","你的平台记录了人们最敏感的对话。求职面试。销售谈判。政府简报。你的用户信任你处理他们明确同意记录的内容。","修复 Firestore 的租户隔离。Firestore 的安全规则就是为此存在的。你已经为其他所有集合正确设置了（users、chats、transcripts、clips、recordings、videos、notes、teams、organizations 全部返回 403）。你只是忘了 meetings。","为世界杯应用添加认证或者下线。你的员工目录只需一次 GET 请求即可获取。","回应安全研究人员。尤其是当他们告诉你，你平台上的每一次会议都可以被任何使用免费账户的人查询时。","再见了，谢谢所有的意大利面 :3"],"translationStatus":"translated","bodyOrigin":"source-page","editorial":{"summary":"研究者称，tl；dv 的 Firestore 会议集合缺乏租户隔离，已认证用户可跨账户查询约18.1万段会议记录。部分正在录制的记录还会暴露可加入的会议ID，形成未经邀请进入实时通话的风险。","background":"tl；dv 是用于 Google Meet、Zoom 和 Teams 的 AI 会议记录平台，可录音、转写并生成摘要。材料称，会议记录包含创建者邮箱、会议服务商、录制状态、时间戳及会议ID，其中部分内容被设为公开状态。","viewpoint":"Aioga 判断，事件的核心并非单条录音泄露，而是访问控制和租户隔离失效可能造成的平台级暴露。值得关注的是，相关结论主要来自研究者披露，平台是否已修复及影响范围仍需官方回应确认。","implications":"若披露属实，会议参与者可能面临录音、转写文本、身份信息及实时会议入口暴露。政府、高校和企业会议涉及的内部讨论也可能被越权访问，但材料未说明是否已有攻击者进行规模化利用。","nextStep":"平台应优先限制跨租户查询、撤销可被滥用的会议访问路径，并审计公开记录与访问日志。用户和机构可检查会议机器人权限、参会审批及历史共享设置，同时等待 tl；dv 发布修复和影响评估。","evidenceRefs":["title","summary","articleBody","source"],"status":"published","aiGenerated":true,"autoApproved":true,"generatedBy":"aioga-editorial:gpt-5.6-sol","reviewedBy":"aioga-editorial-review:gpt-5.6-sol","generatedAt":"2026-08-10T14:58:30.831Z","sourceHash":"8fbd8dff8d6bbd34","review":{"approved":true,"groundedness":94,"clarity":90,"duplicationRisk":18,"blockingIssues":[],"notes":["“形成未经邀请进入实时通话的风险”表述较保守；来源材料称研究者已实际加入马来西亚教育部及美国某大学团队的通话，可酌情补充这一已验证的概念证明。","“撤销可被滥用的会议访问路径”略显抽象，可具体表述为限制会议ID暴露并使已泄露的访问凭据或链接失效。","“Aioga 判断”属于明确标注的分析观点，并未冒充来源事实。"]},"validation":{"passed":true,"mode":"ai-auto","revisions":0,"checks":["schema","length","source-attribution","low-source-overlap","no-html","independent-ai-review"]}},"tags":["行业动态","Hacker News 热门（buzzing.cc 中文翻译）"],"translations":{"zh-CN":{"title":"tl；dv 逾18.1万段AI会议录音被公开暴露，可实时闯入他人通话","summary":"AI会议记录平台tl；dv的Firestore数据库因缺乏租户隔离，任何已认证用户可查询全部18.1万段会议记录，涉及84，312名用户、35，003个域名，含23国政府及多所高校会议。处于录制状态的约1，000场会议会暴露可加入的会议ID，研究者借此闯入马来西亚教育部及美国某大学创业团队的实时通话。该漏洞自2026年1月报告后6个月仍未修复，另有超1，000段会议内容为公开状态。 🔗 阅读原文 via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"bobdahacker.com","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv 逾18.1万段AI会议录音被公开暴露，可实时闯入他人通话 - Aioga AI资讯","description":"AI会议记录平台tl；dv的Firestore数据库因缺乏租户隔离，任何已认证用户可查询全部18.1万段会议记录，涉及84，312名用户、35，003个域名，含23国政府及多所高校会议。处于录制状态的约1，000场会议会暴露可加入的会议ID，研究者借此闯入马来西亚教育部及美国某大学创业团队的实时通话。该漏洞自2026年1月报告后6个月仍未修复，另有超1，00...","url":"https://www.aioga.com/news/cmsnbc14r0aezron58wsytu43/"},"en":{"title":"tl;dv Over 181,000 AI meeting recordings were publicly exposed, potentially allowing real-time intrusion into others' calls","summary":"The AI meeting recording platform tl;dv's Firestore database lacked tenant isolation, allowing any authenticated user to query all 181,000 meeting records, involving 84,312 users and 35,003 domains, including meetings of governments from 23 countries and multiple universities. About 1,000 meetings that were in recording status could expose joinable meeting IDs, enabling researchers to intrude on live calls of the Malaysian Ministry of Education and a startup team at a US university. This vulnerability remained unpatched for six months after being reported in January 2026, and over 1,000 meeting contents were publicly accessible. 🔗 Read the original via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"Industry","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl;dv Over 181,000 AI meeting recordings were publicly exposed, potentially allowing real-time intrusion into others' calls - Aioga AI News","description":"The AI meeting recording platform tl;dv's Firestore database lacked tenant isolation, allowing any authenticated user to query all 181,000 meeting records, involving 84,312 users a...","url":"https://www.aioga.com/en/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:50:35.444Z"},"ja":{"title":"tl；dv 18.1万以上のAI会議録音が公開され暴露され、リアルタイムで他人の通話に侵入可能","summary":"AI会議記録プラットフォームtl；dvのFirestoreデータベースはテナント分離が欠如しており、認証済みの任意のユーザーが全18.1万件の会議記録を照会でき、84,312名のユーザー、35,003のドメイン、23か国の政府や複数の大学の会議が含まれています。録画中の約1,000件の会議では、参加可能な会議IDが公開されており、研究者はこれによりマレーシア教育省やアメリカのある大学の起業チームのリアルタイム通話に侵入しました。この脆弱性は2026年1月に報告されてから6か月経っても修正されておらず、さらに1,000件以上の会議内容が公開状態にあります。 🔗 原文を読む via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"業界動向","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv 18.1万以上のAI会議録音が公開され暴露され、リアルタイムで他人の通話に侵入可能 - Aioga AIニュース","description":"AI会議記録プラットフォームtl；dvのFirestoreデータベースはテナント分離が欠如しており、認証済みの任意のユーザーが全18.1万件の会議記録を照会でき、84,312名のユーザー、35,003のドメイン、23か国の政府や複数の大学の会議が含まれています。録画中の約1,000件の会議では、参加可能な会議IDが公開されており、研究者はこれによりマレーシア...","url":"https://www.aioga.com/ja/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:50:43.693Z"},"ko":{"title":"tl；dv 18.1만 건이 넘는 AI 회의 녹음이 공개적으로 노출되어 다른 사람의 통화에 실시간으로 침입할 수 있음","summary":"AI 회의 기록 플랫폼 tl;dv의 Firestore 데이터베이스는 테넌트 격리가 부족하여, 인증된 모든 사용자가 전체 18.1만 건의 회의 기록을 조회할 수 있으며, 이는 84,312명의 사용자와 35,003개의 도메인을 포함하고, 23개국 정부 및 여러 대학 회의를 포함합니다. 녹화 중인 약 1,000건의 회의는 참여 가능한 회의 ID가 노출되어, 연구자들이 이를 이용해 말레이시아 교육부와 미국 한 대학 창업팀의 실시간 통화에 침입할 수 있습니다. 이 취약점은 2026년 1월 보고 후 6개월이 지나도 여전히 수정되지 않았으며, 그 외에도 1,000건 이상의 회의 내용이 공개 상태로 남아 있습니다. 🔗 원문 보기 via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"업계 동향","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv 18.1만 건이 넘는 AI 회의 녹음이 공개적으로 노출되어 다른 사람의 통화에 실시간으로 침입할 수 있음 - Aioga AI 뉴스","description":"AI 회의 기록 플랫폼 tl;dv의 Firestore 데이터베이스는 테넌트 격리가 부족하여, 인증된 모든 사용자가 전체 18.1만 건의 회의 기록을 조회할 수 있으며, 이는 84,312명의 사용자와 35,003개의 도메인을 포함하고, 23개국 정부 및 여러 대학 회의를 포함합니다. 녹화 중인 약 1,000건의 회의는 참여...","url":"https://www.aioga.com/ko/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:51:32.866Z"},"es":{"title":"tl；dv más de 181,000 grabaciones de reuniones con IA expuestas públicamente, pudiendo irrumpir en llamadas de otros en tiempo real","summary":"La base de datos Firestore de la plataforma de actas de reuniones de IA tl; dv carece de aislamiento de inquilinos, lo que permite que cualquier usuario autenticado pueda consultar todas las 181,000 actas de reuniones, involucrando a 84,312 usuarios, 35,003 dominios, incluyendo reuniones de 23 gobiernos nacionales y varias universidades. Aproximadamente 1,000 reuniones que estaban en estado de grabación exponían IDs de reunión a los que se podía unir, permitiendo a los investigadores acceder a llamadas en tiempo real del Ministerio de Educación de Malasia y del equipo emprendedor de una universidad estadounidense. Esta vulnerabilidad no se había reparado seis meses después de ser reportada en enero de 2026, y más de 1,000 actas de reuniones estaban disponibles públicamente. 🔗 Leer el artículo original vía AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"Industria","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv más de 181,000 grabaciones de reuniones con IA expuestas públicamente, pudiendo irrumpir en llamadas de otros en tiempo real - Aioga Noticias de IA","description":"La base de datos Firestore de la plataforma de actas de reuniones de IA tl; dv carece de aislamiento de inquilinos, lo que permite que cualquier usuario autenticado pueda consultar...","url":"https://www.aioga.com/es/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:51:22.641Z"},"fr":{"title":"tl；dv Plus de 181 000 enregistrements de réunions AI ont été publiés et exposés, pouvant s'immiscer en temps réel dans les appels des autres","summary":"La base de données Firestore de la plateforme de prise de notes de réunion IA tl; dv, en raison de l'absence d'isolement des locataires, permet à tout utilisateur authentifié de consulter l'ensemble des 181 000 enregistrements de réunions, impliquant 84 312 utilisateurs, 35 003 noms de domaine, y compris des réunions de 23 gouvernements et de plusieurs universités. Environ 1 000 réunions en cours d'enregistrement exposent l'ID de réunion pouvant être rejoint, permettant à des chercheurs d'intercepter des appels en direct du ministère de l'Éducation de Malaisie et d'une équipe de start-up d'une université américaine. Cette faille n'a pas été corrigée six mois après avoir été signalée en janvier 2026, et plus de 1 000 contenus de réunions restent publics. 🔗 Lire l'article original via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"Industrie","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv Plus de 181 000 enregistrements de réunions AI ont été publiés et exposés, pouvant s'immiscer en temps réel dans les appels des autres - Aioga Actualités IA","description":"La base de données Firestore de la plateforme de prise de notes de réunion IA tl; dv, en raison de l'absence d'isolement des locataires, permet à tout utilisateur authentifié de co...","url":"https://www.aioga.com/fr/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:52:16.124Z"},"de":{"title":"tl；dv Über 181.000 AI-Meeting-Aufnahmen wurden öffentlich freigelegt, man kann in Echtzeit in andere Anrufe eindringen","summary":"Die Firestore-Datenbank der AI-Konferenzprotokollplattform tl;dv fehlte an Mandantenisolation, wodurch jeder authentifizierte Benutzer auf alle 181.000 Konferenzprotokolle zugreifen konnte, die 84.312 Benutzer, 35.003 Domains sowie Sitzungen von Regierungen aus 23 Ländern und mehreren Hochschulen betreffen. Etwa 1.000 Konferenzen, die sich im Aufzeichnungsmodus befanden, könnten die beitretbaren Meeting-IDs preisgeben, wodurch Forscher in Echtzeitgespräche des malaysischen Bildungsministeriums und des Gründungsteams einer US-amerikanischen Universität eindringen konnten. Dieser Fehler wurde sechs Monate nach der Meldung im Januar 2026 noch nicht behoben, außerdem waren über 1.000 Konferenzinhalte öffentlich zugänglich. 🔗 Originalbeitrag lesen via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv Über 181.000 AI-Meeting-Aufnahmen wurden öffentlich freigelegt, man kann in Echtzeit in andere Anrufe eindringen - Aioga KI-News","description":"Die Firestore-Datenbank der AI-Konferenzprotokollplattform tl;dv fehlte an Mandantenisolation, wodurch jeder authentifizierte Benutzer auf alle 181.000 Konferenzprotokolle zugreife...","url":"https://www.aioga.com/de/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:52:29.053Z"},"pt-BR":{"title":"tl;dv mais de 181.000 gravações de reuniões de IA foram publicamente expostas, podendo invadir chamadas de outras pessoas em tempo real","summary":"A plataforma de registro de reuniões de IA tl;dv tem seu banco de dados Firestore sem isolamento de locatário, permitindo que qualquer usuário autenticado consulte todos os 181 mil registros de reuniões, envolvendo 84.312 usuários, 35.003 domínios, incluindo reuniões de governos de 23 países e várias universidades. Aproximadamente 1.000 reuniões em andamento expõem IDs de reuniões que podem ser ingressadas, permitindo que pesquisadores invadam chamadas ao vivo do Ministério da Educação da Malásia e de equipes de startups de uma universidade dos EUA. Esta vulnerabilidade, relatada em janeiro de 2026, não foi corrigida em seis meses, e mais de 1.000 registros de reuniões permanecem públicos. 🔗 Leia o artigo completo via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl;dv mais de 181.000 gravações de reuniões de IA foram publicamente expostas, podendo invadir chamadas de outras pessoas em tempo real - Aioga Notícias de IA","description":"A plataforma de registro de reuniões de IA tl;dv tem seu banco de dados Firestore sem isolamento de locatário, permitindo que qualquer usuário autenticado consulte todos os 181 mil...","url":"https://www.aioga.com/pt-BR/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:53:11.506Z"},"ru":{"title":"tl；dv более 181 000 записей AI-конференций были публично раскрыты, можно в реальном времени вмешиваться в чужие звонки","summary":"Платформа для записи AI-встреч tl;dv Firestore база данных из-за отсутствия изоляции арендаторов позволяла любому аутентифицированному пользователю получить доступ ко всем 181 000 записей встреч, затрагивая 84 312 пользователей, 35 003 доменных имен, включая встречи правительств 23 стран и нескольких университетов. Около 1 000 встреч, находящихся в состоянии записи, могли раскрывать ID встреч, к которым можно присоединиться; исследователи использовали это, чтобы подключиться к прямым звонкам Министерства образования Малайзии и стартап-команды одного американского университета. Этот уязвимость оставалась неисправленной в течение 6 месяцев после сообщения о ней в январе 2026 года, при этом более 1 000 записей встреч находились в открытом доступе. 🔗 Читать оригинал via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv более 181 000 записей AI-конференций были публично раскрыты, можно в реальном времени вмешиваться в чужие звонки - Aioga Новости ИИ","description":"Платформа для записи AI-встреч tl;dv Firestore база данных из-за отсутствия изоляции арендаторов позволяла любому аутентифицированному пользователю получить доступ ко всем 181 000...","url":"https://www.aioga.com/ru/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:53:11.278Z"},"ar":{"title":"tl；dv تم كشف أكثر من 181 ألف تسجيل اجتماع بواسطة الذكاء الاصطناعي بشكل علني، ويمكن التسلل إلى مكالمات الآخرين في الوقت الفعلي","summary":"منصة تسجيل اجتماعات AI tl;dv لقاعدة بيانات Firestore تعرضت لمشكلة بسبب نقص العزل بين المستأجرين، حيث يمكن لأي مستخدم مصدق عليه الاطلاع على جميع 181,000 مقطع تسجيل اجتماع، تشمل 84,312 مستخدمًا و35,003 نطاقًا، بما في ذلك اجتماعات حكومات 23 دولة والعديد من الجامعات. حوالي 1,000 اجتماع في حالة التسجيل تعرض معرفات الاجتماعات التي يمكن الانضمام إليها، واستغل الباحثون ذلك لاقتحام محادثات مباشرة مع وزارة التعليم الماليزية وفريق ريادة الأعمال في إحدى الجامعات الأمريكية. لم يتم إصلاح هذه الثغرة بعد 6 أشهر من الإبلاغ عنها في يناير 2026، بالإضافة إلى أن أكثر من 1,000 مقطع اجتماع كانت متاحة للعامة. 🔗 قراءة النص الأصلي عبر AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv تم كشف أكثر من 181 ألف تسجيل اجتماع بواسطة الذكاء الاصطناعي بشكل علني، ويمكن التسلل إلى مكالمات الآخرين في الوقت الفعلي - Aioga أخبار الذكاء الاصطناعي","description":"منصة تسجيل اجتماعات AI tl;dv لقاعدة بيانات Firestore تعرضت لمشكلة بسبب نقص العزل بين المستأجرين، حيث يمكن لأي مستخدم مصدق عليه الاطلاع على جميع 181,000 مقطع تسجيل اجتماع، تشمل 84,3...","url":"https://www.aioga.com/ar/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:53:56.501Z"},"hi":{"title":"tl；dv 18.1万 से अधिक AI मीटिंग रिकॉर्ड सार्वजनिक रूप से उजागर हुए, और किसी की कॉल में वास्तविक समय में घुसपैठ की जा सकती है","summary":"एआई会议记录平台 tl;dv का Firestore डेटाबेस किरायेदार पृथक्करण की कमी के कारण, किसी भी प्रमाणित उपयोगकर्ता को सभी 1,81,000会议记录查询 करने की अनुमति देता है, जो 84,312 उपयोगकर्ताओं, 35,003 डोमेन नामों, 23 देशों की सरकारों और कई विश्वविद्यालयों की बैठक से संबंधित हैं। लगभग 1,000 चल रही बैठकों का रिकॉर्डिंग स्थिति में होने के कारण संभावित会议ID उजागर होती है, शोधकर्ताओं ने इसका उपयोग करके मलेशिया शिक्षा मंत्रालय और अमेरिका के एक विश्वविद्यालय की स्टार्टअप टीम की रीयल-टाइम कॉल में प्रवेश किया। यह漏洞 जनवरी 2026 में रिपोर्ट होने के 6 महीने बाद भी अनसुलझा रहा है, और 1,000 से अधिक会议内容 सार्वजनिक स्थिति में हैं। 🔗 मूल लेख पढ़ें via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv 18.1万 से अधिक AI मीटिंग रिकॉर्ड सार्वजनिक रूप से उजागर हुए, और किसी की कॉल में वास्तविक समय में घुसपैठ की जा सकती है - Aioga AI समाचार","description":"एआई会议记录平台 tl;dv का Firestore डेटाबेस किरायेदार पृथक्करण की कमी के कारण, किसी भी प्रमाणित उपयोगकर्ता को सभी 1,81,000会议记录查询 करने की अनुमति देता है, जो 84,312 उपयोगकर्ताओं, 35,003 डोम...","url":"https://www.aioga.com/hi/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:54:07.939Z"},"it":{"title":"tl；dv Più di 181.000 registrazioni di riunioni AI sono state esposte pubblicamente, con possibilità di intrusione in tempo reale nelle chiamate altrui","summary":"La piattaforma di registrazione delle riunioni AI tl;dv, a causa della mancanza di isolamento tra tenant nel database Firestore, permetteva a qualsiasi utente autenticato di consultare tutte le 181.000 registrazioni di riunioni, coinvolgendo 84.312 utenti, 35.003 domini, comprese riunioni di 23 governi e di diverse università. Circa 1.000 riunioni in fase di registrazione esponevano gli ID delle riunioni a cui era possibile unirsi, consentendo ai ricercatori di accedere alle chiamate in tempo reale del Ministero dell'Istruzione della Malaysia e di un team di start-up di un'università americana. La vulnerabilità, segnalata a gennaio 2026, non era ancora stata risolta dopo sei mesi, e più di 1.000 contenuti di riunioni erano in stato pubblico. 🔗 Leggi l'articolo completo via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv Più di 181.000 registrazioni di riunioni AI sono state esposte pubblicamente, con possibilità di intrusione in tempo reale nelle chiamate altrui - Aioga Notizie IA","description":"La piattaforma di registrazione delle riunioni AI tl;dv, a causa della mancanza di isolamento tra tenant nel database Firestore, permetteva a qualsiasi utente autenticato di consul...","url":"https://www.aioga.com/it/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:54:52.440Z"},"nl":{"title":"tl；dv Meer dan 181.000 AI-vergaderopnames zijn openbaar blootgesteld, kunnen in realtime in andermans gesprekken binnendringen","summary":"Het Firestore-databasesysteem van het AI-vergaderplatform tl;dv had geen scheiding tussen huurders, waardoor elke geverifieerde gebruiker toegang kon krijgen tot alle 181.000 vergaderingsnotities, betrekking hebbend op 84.312 gebruikers en 35.003 domeinen, inclusief vergaderingen van regeringen van 23 landen en meerdere universiteiten. Ongeveer 1.000 vergaderingen die werden opgenomen, blootstonden aan blootstelling van toegankelijke vergaderings-ID's, waardoor onderzoekers konden binnendringen in real-time gesprekken van het Maleisische ministerie van Onderwijs en een start-upteam van een Amerikaanse universiteit. Deze kwetsbaarheid werd gerapporteerd in januari 2026 en was zes maanden later nog steeds niet verholpen; daarnaast waren meer dan 1.000 vergaderingsinhouden openbaar toegankelijk. 🔗 Lees het originele artikel via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv Meer dan 181.000 AI-vergaderopnames zijn openbaar blootgesteld, kunnen in realtime in andermans gesprekken binnendringen - Aioga AI-nieuws","description":"Het Firestore-databasesysteem van het AI-vergaderplatform tl;dv had geen scheiding tussen huurders, waardoor elke geverifieerde gebruiker toegang kon krijgen tot alle 181.000 verga...","url":"https://www.aioga.com/nl/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:54:58.552Z"},"tr":{"title":"tl；dv 18,1 binden fazla AI toplantı kaydı ifşa edildi, başkalarının görüşmelerine gerçek zamanlı olarak girebilir","summary":"AI toplantı kayıt platformu tl;dv'nin Firestore veritabanı, kiracı izolasyonunun eksikliğinden dolayı, herhangi bir doğrulanmış kullanıcı tarafından tüm 181.000 toplantı kaydına erişilebilir durumdaydı. Bu kayıtlar 84.312 kullanıcıyı, 35.003 alan adını ve 23 ülke hükümeti ile birçok üniversitenin toplantılarını içeriyordu. Kaydedilmekte olan yaklaşık 1.000 toplantı, katılınabilecek toplantı kimliklerini ifşa ediyordu; araştırmacılar bunu kullanarak Malezya Eğitim Bakanlığı ve Amerika'daki bir üniversitenin girişim ekibinin canlı görüşmelerine sızdı. Bu güvenlik açığı, 2026 Ocak ayında rapor edildikten sonraki 6 ay boyunca düzeltilmedi; ayrıca 1.000'den fazla toplantı içeriği herkese açık durumdaydı. 🔗 Orijinal metni okuyun via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv 18,1 binden fazla AI toplantı kaydı ifşa edildi, başkalarının görüşmelerine gerçek zamanlı olarak girebilir - Aioga AI Haberleri","description":"AI toplantı kayıt platformu tl;dv'nin Firestore veritabanı, kiracı izolasyonunun eksikliğinden dolayı, herhangi bir doğrulanmış kullanıcı tarafından tüm 181.000 toplantı kaydına er...","url":"https://www.aioga.com/tr/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:55:42.754Z"},"vi":{"title":"tl；dv Hơn 181.000 bản ghi âm cuộc họp AI bị công khai, có thể xâm nhập cuộc gọi của người khác theo thời gian thực","summary":"Nền tảng ghi chú cuộc họp AI tl;dv Firestore database do thiếu khả năng phân tách tenant, bất kỳ người dùng đã xác thực nào cũng có thể truy vấn toàn bộ 181.000 đoạn ghi chú cuộc họp, liên quan đến 84.312 người dùng, 35.003 tên miền, bao gồm các cuộc họp của 23 chính phủ quốc gia và nhiều trường đại học. Khoảng 1.000 cuộc họp đang ở trạng thái ghi hình có thể lộ ID cuộc họp có thể tham gia, các nhà nghiên cứu đã lợi dụng để xâm nhập cuộc gọi trực tiếp của Bộ Giáo dục Malaysia và nhóm khởi nghiệp của một trường đại học ở Mỹ. Lỗ hổng này vẫn chưa được khắc phục 6 tháng sau khi được báo cáo vào tháng 1 năm 2026, và còn có hơn 1.000 đoạn nội dung cuộc họp ở trạng thái công khai. 🔗 Đọc bản gốc qua AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv Hơn 181.000 bản ghi âm cuộc họp AI bị công khai, có thể xâm nhập cuộc gọi của người khác theo thời gian thực - Tin tức AI Aioga","description":"Nền tảng ghi chú cuộc họp AI tl;dv Firestore database do thiếu khả năng phân tách tenant, bất kỳ người dùng đã xác thực nào cũng có thể truy vấn toàn bộ 181.000 đoạn ghi chú cuộc h...","url":"https://www.aioga.com/vi/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:55:46.494Z"},"id":{"title":"tl;dv lebih dari 181.000 rekaman rapat AI terbuka, dapat masuk ke panggilan orang lain secara real-time","summary":"Platform catatan rapat AI tl;dv Firestore database karena kurangnya isolasi tenant, setiap pengguna yang sudah terautentikasi dapat mengakses semua 181.000 potongan catatan rapat, melibatkan 84.312 pengguna, 35.003 domain, termasuk rapat pemerintah dari 23 negara dan beberapa universitas. Sekitar 1.000 rapat yang sedang direkam dapat mengekspos ID rapat yang dapat diikuti, peneliti menggunakan ini untuk menyusup ke panggilan langsung Kementerian Pendidikan Malaysia dan tim startup universitas di Amerika Serikat. Kerentanan ini masih belum diperbaiki 6 bulan setelah dilaporkan pada Januari 2026, dan lebih dari 1.000 potongan catatan rapat berada dalam status publik. 🔗 Baca artikel asli via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl;dv lebih dari 181.000 rekaman rapat AI terbuka, dapat masuk ke panggilan orang lain secara real-time - Berita AI Aioga","description":"Platform catatan rapat AI tl;dv Firestore database karena kurangnya isolasi tenant, setiap pengguna yang sudah terautentikasi dapat mengakses semua 181.000 potongan catatan rapat,...","url":"https://www.aioga.com/id/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:56:32.030Z"},"th":{"title":"tl；dv เกิน 181,000 ส่วนของการบันทึกการประชุม AI ถูกเปิดเผยอย่างสาธารณะ สามารถเข้าร่วมการโทรของผู้อื่นได้แบบเรียลไทม์","summary":"แพลตฟอร์มบันทึกการประชุม AI tl;dv ในฐานข้อมูล Firestore เนื่องจากขาดการแยกผู้เช่า ผู้ใช้ที่ผ่านการรับรองใด ๆ สามารถค้นหาบันทึกการประชุมทั้งหมด 181,000 รายการ ซึ่งเกี่ยวข้องกับผู้ใช้ 84,312 คน, โดเมน 35,003 แห่ง รวมถึงการประชุมของรัฐบาล 23 ประเทศและหลายมหาวิทยาลัย การประชุมที่อยู่ในสถานะบันทึกประมาณ 1,000 ครั้ง จะเปิดเผย ID การประชุมที่สามารถเข้าร่วมได้ นักวิจัยใช้จุดนี้บุกรุกการโทรสดของกระทรวงศึกษาธิการมาเลเซียและทีมสตาร์ทอัพของมหาวิทยาลัยในสหรัฐอเมริกา ช่องโหว่นี้รายงานตั้งแต่เดือนมกราคม 2026 แต่ยังไม่ถูกแก้ไขเป็นเวลา 6 เดือน นอกจากนี้ยังมีบันทึกการประชุมมากกว่า 1,000 รายการที่อยู่ในสถานะสาธารณะ 🔗 อ่านต้นฉบับ via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv เกิน 181,000 ส่วนของการบันทึกการประชุม AI ถูกเปิดเผยอย่างสาธารณะ สามารถเข้าร่วมการโทรของผู้อื่นได้แบบเรียลไทม์ - ข่าว AI Aioga","description":"แพลตฟอร์มบันทึกการประชุม AI tl;dv ในฐานข้อมูล Firestore เนื่องจากขาดการแยกผู้เช่า ผู้ใช้ที่ผ่านการรับรองใด ๆ สามารถค้นหาบันทึกการประชุมทั้งหมด 181,000 รายการ ซึ่งเกี่ยวข้องกับผู้ใช...","url":"https://www.aioga.com/th/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:56:44.042Z"},"pl":{"title":"tl；dv ponad 181 000 nagrań spotkań AI zostało publicznie ujawnionych, można w czasie rzeczywistym wchodzić w cudze rozmowy","summary":"Platforma do rejestrowania spotkań AI tl;dv, korzystająca z bazy danych Firestore, nie posiadała izolacji najemców, co oznacza, że każdy zalogowany użytkownik mógł przeglądać wszystkie 181 000 segmentów nagrań spotkań, dotyczące 84 312 użytkowników i 35 003 domen, w tym spotkania rządów 23 krajów i wielu uniwersytetów. Około 1 000 spotkań w trakcie nagrywania ujawnia identyfikatory dostępnych spotkań, co pozwoliło badaczom na wejście w czasie rzeczywistym do rozmów Ministerstwa Edukacji Malezji oraz zespołu startupowego uniwersytetu w USA. Luka ta nie została naprawiona przez 6 miesięcy od zgłoszenia w styczniu 2026 roku; dodatkowo ponad 1 000 segmentów spotkań było publicznie dostępnych. 🔗 Przeczytaj oryginał via AIHOT · https://aihot.virxact.com/items/cmsnbc14r0aezron58wsytu43","category":"行业动态","source":"Hacker News 热门（buzzing.cc 中文翻译）","aggregationSource":"Hacker News 热门（buzzing.cc 中文翻译）","pageTitle":"tl；dv ponad 181 000 nagrań spotkań AI zostało publicznie ujawnionych, można w czasie rzeczywistym wchodzić w cudze rozmowy - Aioga Wiadomości AI","description":"Platforma do rejestrowania spotkań AI tl;dv, korzystająca z bazy danych Firestore, nie posiadała izolacji najemców, co oznacza, że każdy zalogowany użytkownik mógł przeglądać wszys...","url":"https://www.aioga.com/pl/news/cmsnbc14r0aezron58wsytu43/","contentTranslated":true,"sourceHash":"41fe9b09d5fe4e4b","translatedAt":"2026-08-10T14:57:35.454Z"}}}}