Gyazo (Helpfeel): an image-upload-server vulnerability reaches arbitrary command execution, exposing 23.62 million user records and 490 million image-metadata records
Helpfeel's 'unguessable link' privacy model for Gyazo collapsed once the image IDs themselves leaked from the backend
Analysis
Helpfeel Inc. (Kyoto, Japan) disclosed on 2026-09-16 that on 2026-09-11 a third party exploited a vulnerability in the image-upload server of Gyazo, its screenshot-sharing service, executed arbitrary commands and accessed Gyazo's database (Helpfeel Inc., 2026-09-16). Helpfeel has not named the flaw class (The Hacker News, 2026-09-17). About 23.62 million user records were exposed, including email addresses, password hashes and login session IDs, together with about 490 million image-metadata records, mostly for images registered in or before January 2019, that include the image IDs used to build Gyazo image links (Helpfeel Inc., 2026-09-16). A capture at Gyazo's default setting is protected only by its link, so the leaked image IDs remove that protection (The Hacker News, 2026-09-17). Helpfeel says the attacker also obtained a list identifying private images and that it cannot rule out that some of them were viewed (Helpfeel Inc., 2026-09-16).
Cited evidence
On September 11, 2026, a third party exploited a vulnerability in Gyazo's image upload server to gain unauthorized access to our systems and execute arbitrary commands.
We have also confirmed that the third party obtained a list identifying private images. As we cannot rule out the possibility that some private images may have been viewed by the third party, we are continuing our detailed investigation.
Updates1
Helpfeel lists an X (formerly Twitter) integration token and the email address associated with Google single sign-on among the exposed user fields, not a Google SSO token (Helpfeel Inc., 2026-09-16). For a capture at Gyazo's default setting, the link is the only protection, so the leaked image IDs remove it. Captures set to "Only me" cannot be viewed even by someone who knows the link, according to Gyazo's help pages as reported by The Hacker News (The Hacker News, 2026-09-17).
Sources2
Revision history
- Published 2026-09-18T0410Z-intel
- Correction 2026-09-30T0639Z-audit
Priority recalibrated from notable to routine: a Japanese consumer image-hosting breach with no product or technique relevant to Swiss public bodies, so it is awareness only, and the main text is shortened to the breach, the exposure that matters and Helpfeel's guidance to users. The exposed user fields follow Helpfeel's list, which names an X integration token and the Google sign-on email address rather than SSO tokens. The summary no longer calls the affected images private: captures on the default setting are protected only by their link, so the leaked image IDs remove that protection.
Changed: priority sourcing_note body summary
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.