Summary
After deleting an account, user-uploaded personal data such as profile picture remains publicly accessible through its direct URL. Although the application indicates that the account has been permanently deleted, the associated personal data continues to be accessible without authentication.
This creates a GDPR/privacy issue because users reasonably expect that deleting their account removes or makes inaccessible their personal information. Instead, anyone possessing the direct URL can continue accessing the deleted user's data.
Steps to Reproduce
Register a new account on amplenote.com.
Go to "Account settings" > "Personal profile" and upload a picture.
Open the profile image by right clicking "Open image in new tab" and copy its direct URL.
Delete the account using the application's account deletion feature (account settings > danger zone > Delete my account).
Wait until the deletion process completes.
Open the previously copied image URL in a browser.
Actual Result
The profile image remains publicly accessible even though the associated account has been deleted.
No authentication is required to retrieve the image.
Expected Result
After an account is deleted:
All user-owned personal data should be deleted or permanently inaccessible.
Previously issued public URLs should immediately return 404 Not Found, 403 Forbidden, or another appropriate response.
Deleted user content should no longer be retrievable.
Security Impact
Potential consequences include:
Continued exposure of personally identifiable information (PII).
Violation of users' expectations regarding permanent and immediat account deletion.
Privacy risks if profile images contain identifiable information.
Increased risk of unauthorized collection and archival of deleted user data.
Potential non-compliance with privacy regulations such as GDPR's "Right to Erasure" (Article 17).
Increased legal and reputational risk if personal data remains accessible after deletion.
Remediation
Immediately invalidate all public object URLs associated with deleted accounts.
Configure storage/CDN to purge cached objects upon deletion.
Return 404 Not Found or 403 Forbidden for requests to deleted resources.
CWE-359: Exposure of Private Personal Information (PPI) to an Unauthorized Actor