Telangana Dental Council portal goes offline after data leak

A cybersecurity researcher flagged an IDOR vulnerability in the Telangana State Dental Council portal that exposed dentists’ personal details and academic documents. The affected section was taken offline after public criticism, prompting concerns over data protection and accountability.

Hyderabad: A critical data security lapse on the official web portal of the Telangana State Dental Council left sensitive personal and academic records of registered dental doctors exposed for several days before authorities scrambled to secure the vulnerable section.

The serious vulnerability came to light after cybersecurity researcher and content creator Ankit Sahay (@thebrokenapp) highlighted the issue in a detailed video breakdown.

---

Demonstrating the flaw in the Council’s portal document re-upload and account recovery section (telanganastatedentalcouncil.in/reupload_documents.php), Sahay pointed out that the website suffered from an Insecure Direct Object Reference (IDOR) vulnerability.

The Telangana Dental Council portal allowed anyone to access confidential professional profiles simply by modifying sequential numerical ID counters, such as shifting from ID 0041 to 0042, without requiring login credentials, session authentication or authorisation checks, Sahay said in the video.

The loophole exposed vast amounts of personally identifiable information (PII), including registered dentists’ full names, profile photographs, mobile numbers, residential addresses with PIN codes and government-issued identification numbers.

Moreover, anyone could freely open and download highly sensitive personal files, such as school mark sheets, college degree certificates, examination attempt records and internship completion letters, Sahay said in his post.

Responding to Sahay’s post, social media users and doctors pointed out that the sensitive database had remained exposed to potential bulk scraping and identity theft for several days. State Dental Council authorities reacted only after public criticism mounted, and the affected section was pulled offline.

Following the widespread circulation of the security failure, the specific section of the portal was abruptly taken offline.

Visitors attempting to access the URL are now greeted with an ‘Under Development’ maintenance screen carrying a notice that reads: ‘We’re working towards upgrade the application. Backonline in 24Hrs!’.

The incident and Sahay’s social media post have triggered widespread concern among medical professionals over digital accountability. Doctors have raised urgent questions about cybersecurity measures and vulnerability management in State-run professional registries handling critical citizen data.