Second Breach in a Month Exposes 17,000 Smart Sampa Cameras via IDOR Flaw
A new security flaw in São Paulo's Smart Sampa surveillance program exposed live feeds from 17,000 cameras belonging to companies partnered with the city, accessible without password or authentication for five days before being taken down. This is the second large-scale exposure in under a month, following an earlier incident on October 20 that exposed 58,000 cameras. The feeds were hosted by Monuv, a cloud storage provider for security cameras, and included views near the residences of STF Justice Alexandre de Moraes and former presidents Michel Temer and Fernando Henrique Cardoso, as well as entrances to private clubs. The vulnerability also exposed LGPD-protected data belonging to partner companies, including registration records and documents.
Entenda a falha
A vulnerabilidade
No CVE was assigned. The flaw exposed live feeds from about 17,000 cameras of companies partnered with Smart Sampa, hosted on the Monuv cloud platform, with no password. It also exposed registration records and partner documents (LGPD-protected data). Per a cybersecurity source quoted by UOL, files from a website tied to Sentinelx revealed backend service addresses used to query company and camera data. The reporting also describes an IDOR, where changing record or document identifiers reaches restricted data without an authorization check. The links were taken down on October 30 after about five days. The articles give no affected or fixed versions.
Como funciona
The Sentinelx-linked website shipped source files that were publicly reachable and named the backend services the platform uses to query company and camera data. Anyone who read them could call those services directly. The services returned registrations, partner documents and complete transmission links, which could be played outside the official system. In the IDOR case, the service accepts an identifier for a record or document and returns it without checking that the requester is allowed to see it, so changing the identifier returns other people's data.
Por que é vulnerável
The articles point to missing authorization checks on the backend endpoints (the IDOR) and to the exposure of service addresses in publicly available source files. The transmission links also appear to have worked without authentication, so anyone holding a link could watch the feed. Researcher Penegui added that putting access endpoints under the same domain used to promote the product raises the risk: if that domain is compromised, all cameras may be too. The articles describe no fix beyond taking the links offline.
Como foi descoberta
UOL reported the exposure after a cybersecurity-sector source, who was not named, pointed to the flaw in a Sentinelx-linked website's source code. UOL contacted the city, Sentinelx and Monuv on October 29, and the links were taken down on October 30. Researcher Davi Mikael Cezar (Penegui) analyzed public information and found 15 Smart Sampa credentials from 2024 to 2026 in leaked data, which he says infostealers harvested. Folha de S.Paulo found that equipment in other municipalities was also reachable, including a license-plate camera in Campo Grande (MS). The city disputes that the link list was public. It says it was an internal PRODAM spreadsheet from a review begun October 20, and calls its delivery to UOL an illegal leak.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 10:20.
Detalhes técnicos
The flaw, distinct from the October exposure, originated in source code of a website linked to Sentinelx, the company managing Smart Sampa's technology. Publicly available files revealed backend service endpoints used to query company and camera data, enabling attackers to retrieve registrations, partner documents, and complete transmission links playable outside the official system. Researchers identified an IDOR (Insecure Direct Object Reference) vulnerability allowing manipulation of record/document identifiers to bypass authorization checks. Researcher Davi Mikael Cezar (Penegui) warned that consolidating access endpoints under the same domain used for public product promotion increases compromise risk, and found 15 leaked Smart Sampa credentials (from 2024-2026) in breached data dumps, reportedly harvested by infostealer malware from infected devices. Reporting by Folha de S.Paulo showed the flaw also exposed equipment in other municipalities, including a license-plate reading camera in Campo Grande (MS) accessed via a São Paulo login. Sentinelx reportedly also operates subdomains referencing other cities (Guarulhos, Campinas, Joinville, Goiânia, Mairiporã, Catanduva) that use Smart Sampa as a sales reference.
Remediação
The exposed links were taken offline on October 30, a day after UOL contacted the city government, Sentinelx, and Monuv. The São Paulo city government disputed that the link list was publicly available, claiming it was an internal spreadsheet produced by PRODAM during a cybersecurity review ordered by Mayor Ricardo Nunes, and stated the program continues operating normally with no evidence of external attacks; it also said the city's own 20,000+ cameras were not included in the exposed data. The city characterized sharing the file with UOL as an illegal leak and announced administrative and legal action. Monuv stated it maintains access controls, authentication, and data/transmission protections. Sentinelx did not respond to inquiries.
Linha do tempo
-
Second Breach in a Month Exposes 17,000 Smart Sampa Cameras via IDOR Flaw
ler a análise desta fonte ocultar
A new security flaw in São Paulo's Smart Sampa surveillance program exposed live feeds from 17,000 cameras belonging to companies partnered with the city, accessible without password or authentication for five days before being taken down. This is the second large-scale exposure in under a month, following an earlier incident on October 20 that exposed 58,000 cameras. The feeds were hosted by Monuv, a cloud storage provider for security cameras, and included views near the residences of STF Justice Alexandre de Moraes and former presidents Michel Temer and Fernando Henrique Cardoso, as well as entrances to private clubs. The vulnerability also exposed LGPD-protected data belonging to partner companies, including registration records and documents.
Technical Details
The flaw, distinct from the October exposure, originated in source code of a website linked to Sentinelx, the company managing Smart Sampa's technology. Publicly available files revealed backend service endpoints used to query company and camera data, enabling attackers to retrieve registrations, partner documents, and complete transmission links playable outside the official system. Researchers identified an IDOR (Insecure Direct Object Reference) vulnerability allowing manipulation of record/document identifiers to bypass authorization checks. Researcher Davi Mikael Cezar (Penegui) warned that consolidating access endpoints under the same domain used for public product promotion increases compromise risk, and found 15 leaked Smart Sampa credentials (from 2024-2026) in breached data dumps, reportedly harvested by infostealer malware from infected devices. Reporting by Folha de S.Paulo showed the flaw also exposed equipment in other municipalities, including a license-plate reading camera in Campo Grande (MS) accessed via a São Paulo login. Sentinelx reportedly also operates subdomains referencing other cities (Guarulhos, Campinas, Joinville, Goiânia, Mairiporã, Catanduva) that use Smart Sampa as a sales reference.
Remediation
The exposed links were taken offline on October 30, a day after UOL contacted the city government, Sentinelx, and Monuv. The São Paulo city government disputed that the link list was publicly available, claiming it was an internal spreadsheet produced by PRODAM during a cybersecurity review ordered by Mayor Ricardo Nunes, and stated the program continues operating normally with no evidence of external attacks; it also said the city's own 20,000+ cameras were not included in the exposed data. The city characterized sharing the file with UOL as an illegal leak and announced administrative and legal action. Monuv stated it maintains access controls, authentication, and data/transmission protections. Sentinelx did not respond to inquiries.