Technology

Gravatar API lets you scrape millions of user profiles

Yesterday, I reported on BleepingComputer how Gravatar API makes it easy for web scrapers and bots to automatically enumerate Gravatar profiles and download user data.

While the official documentation indicates that users should only be able to access Gravatar profiles if they know the usernames or account email, the method discovered by a security researcher finds a hidden route which renders that guideline moot.

Italian security researcher, Carlo Di Dato discovered that the hidden URL API routes as those shown below can allow a web scraper or bot to enumerate every single Gravatar profile and collect its public data.

http://en.gravatar.com/1.json
http://en.gravatar.com/2.json
http://en.gravatar.com/3.json


Similar endpoints exist for obtaining data in other formats too, e.g. my own Gravatar profile (ID 178860042) has an XML representation in addition to JSON’s:
http://en.gravatar.com/178860042.xml

According to a YCombinator’s Hacker News user, there are upwards of 194.13 million Gravatar profiles up for scraping because of this intentional design flaw.

Image: Profiles beyond ID 194,130,000 continue to bring up valid results

This figure is of course, an approximate estimate as using profile IDs beyond this number continued to bring up valid Gravatar user data.

It is unlikely that Gravatar will be patching this design flaw.

The fact that the user data being returned by the API is already public means this does not constitute a data leak or privacy violation.

However, as Di Dato told BleepingComputer, this design choice makes it easier for anyone to enumerate user accounts and engage in mass data collection:

Referring to a Gravatar user whose data Di Dato was able to view, the researcher said, “Of course, Mr. Stephen knows that registering on Gravatar, his data will be publicly accessible. What I’m almost sure he doesn’t know, is that I was able to retrieve this data querying Gravatar in a way which should not be possible.”

He continued telling BleepingComputer, “As Gravatar states in its guides, I should have Mr. Stephen’s email address or his Gravatar user name to perform the query. Without this information, it should have been almost impossible for me to get Mr. Stephen’s data, right?” 

Design choices that enable user enumeration of public data may not seem like an obvious security issue, however, what is preventing a spammer from abusing this design choice and build a marketing list of over a million contacts – especially for profiles which have their email address and phone number exposed in them.

Ax Sharma

Ax Sharma is a UK-based security researcher, journalist and TV subject matter expert experienced in malware analysis and cybercrime investigations. His areas of interest include open source software security and threat intel analysis. Frequently featured by leading media outlets like the BBC, Channel 5, Fortune, WIRED, The Register, among others, Ax is an active community member of the OWASP Foundation and the British Association of Journalists (BAJ).

Recent Posts

ParkMobile’s $32.8 Million Data Breach Settlement = You get $1?

In 2021, parking app ParkMobile suffered a massive data breach impacting 22 million users whose…

3 days ago

8 Brutal Truths About Cybersecurity I Wish I Knew

When I first got into cybersecurity, I thought it was all about hackers in hoodies…

4 days ago

US Air Force Probes Potential SharePoint-Linked Privacy Breach

The US Air Force is investigating a “privacy-related issue” that may have exposed personally identifiable…

5 days ago

Harrods third-party breach exposes 430,000 customer records, hackers reach out

London’s iconic department store Harrods has disclosed that approximately 430,000 customer records were compromised in…

1 week ago

WestJet confirms customer ID, passports stolen in June cyberattack

WestJet confirmed that in a June 2025 cybersecurity incident, a “sophisticated, criminal third party” gained…

1 week ago

Did You Also Get a ‘Real’ Phishing Email From GitHub.com?

Imagine getting an email straight from GitHub’s own notification system: the same one you've trusted…

1 week ago

This website uses cookies.