{"data":{"id":2185,"lang":"en","title":"AI Notetaker tl;dv Left 181,874 Meetings Exposed for Six Months","summary":"A researcher found tl;dv exposed 181,874 meetings from 84,000+ users for six months due to a missing tenant-isolation rule, letting attackers join live calls undetected.","category":"technology","category_label":"Technology","published_at":"2026-08-14T06:01:11Z","updated_at":"2026-08-14T06:01:11Z","url":"https://techtools.cz/tools/news/article/2185-ai-notetaker-tl-dv-left-181-874-meetings-exposed-for-six-months","api_url":"https://techtools.cz/news-api/v1/articles/2185?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2185.md?lang=en","image_url":"https://blog.netizen.net/wp-content/uploads/2026/08/istock-2222382331.jpg?w=1024","word_count":197,"reading_time_minutes":1,"sources":[{"url":"https://bobdahacker.com/blog/tldv-hack","domain":"bobdahacker.com"},{"url":"https://blog.netizen.net/2026/08/04/inside-the-tldv-flaw-that-exposed-live-government-and-corporate-meetings/","domain":"blog.netizen.net"}],"translation":{"lang":"cs","id":2258,"title":"AI zapisovač schůzek tl;dv nechal půl roku odhalených 181 874 schůzek","url":"https://techtools.cz/tools/news/clanek/2258-ai-zapisovac-schuzek-tl-dv-nechal-pul-roku-odhalenych-181-874-schuzek","api_url":"https://techtools.cz/news-api/v1/articles/2258?lang=cs"},"content":"A security researcher has disclosed a critical flaw in tl;dv, an AI meeting-notetaker used by more than 2 million people, that let any logged-in user query metadata for every meeting on the platform. The exposed Cloud Firestore \"meetings\" collection had no tenant isolation, unlike every other collection in the database, meaning a valid account was all it took to see records belonging to other customers.\n\nThe leak covered 181,874 meetings tied to 84,312 unique users across 35,003 email domains, including government agencies in 23 countries and major universities. Exposed data included meeting creator emails, timestamps, recording status, and conference identifiers for calls in progress. By impersonating tl;dv's own notetaker bot, the researcher was able to join live meetings undetected in roughly 80% of tested cases.\n\nThe researcher first reported the bug on January 28, 2026, and followed up repeatedly through July, but says tl;dv's CTO never responded despite the company's public promise of a 24-hour security response. The incident highlights a recurring class of bug known as broken object-level authorization, where an app checks that a user is logged in but not whether they actually belong to the resource being requested."}}