Parliament Wide Open

Summary

The Albanian Parliament (parlament.al) serves a React SPA frontend backed by an ASP.NET OData API hosted on Azure. The API requires zero authentication. Any person on the internet can query the OData API at kuvendiapi.azurewebsites.net and retrieve full personally identifiable information for all 236 Members of Parliament, plus a catalog of 54,545 publicly accessible Azure Blob Storage documents.

Discovery Method

parlament.al returns HTTP 200 for all URL paths — a React SPA catch-all that initially appeared to be a dead end. Standard endpoint probing produced no results. However:

1. The main React JS bundle was downloaded: main.[hash].js (355 KB minified)
2. String extraction from the minified bundle revealed a hardcoded API base URL: https://kuvendiapi.azurewebsites.net/api
3. Further analysis of minified webpack variable names extracted seven OData entity names: anetaret, strukturat, aktet, lajmet, mbledhjet, dokumentet, YouTube/search
4. All seven endpoints responded to unauthenticated HTTP GET requests
5. One additional endpoint (/abonimet) was probed and returned 401 — the only protected endpoint in the API

No authentication was bypassed. No exploits were used. The API was wide open by default.

Open API Endpoints

MP PII Exposure — 236 Records

Each record in the /anetaret response contains the following fields for every Member of Parliament:

• Full legal name: first name (Emri), father’s name (Atesia), surname (Mbiemri)
• Date of birth (Datelindja)
• Place of birth (Vendlindja)
• Official email address — @parlament.al
• Political party affiliation (Partia)
• Electoral district (Zona)
• Profile photo URL (Azure Blob Storage)
• Social media: Facebook, Twitter/X, LinkedIn links
• Active / inactive status (Aktiv)

Additionally, a separate anetaret_active.json response filters to currently active MPs. An mp-email-list.txt of all 236 @parlament.al addresses was compiled from the API response (24 KB).

GET https://kuvendiapi.azurewebsites.net/api/anetaret
HTTP/1.1 200 OK
Content-Type: application/json; odata.metadata=minimal

{
  "Emri":       "[REDACTED]",
  "Atesia":     "[REDACTED]",
  "Mbiemri":    "[REDACTED]",
  "Datelindja": "1975-XX-XX",
  "Vendlindja": "Tiranë",
  "Email":      "[REDACTED]@parlament.al",
  "Partia":     "Partia Socialiste",
  "Zona":       "Tiranë",
  "Facebook":   "https://facebook.com/[REDACTED]",
  "Aktiv":      true
}

Azure Blob Storage — 54,545 Public Documents

The /dokumentet endpoint returns a 30.2 MB JSON catalog. Container listing on kuvendiwebfiles.blob.core.windows.net/webfiles/ is disabled — but all 54,545 blob URLs are enumerable via the API response, and individual blobs have public read access enabled. Direct URL construction from the catalog entries retrieves documents without authentication.

Key Documents Identified in the Catalog

• MP Salary Spreadsheets (PAGA DEPUTETE) — monthly, 2018–2020
• MP Benefits Records (PERFITIME DEPUTETE) — monthly, 2018–2020
• Lobbyist Registry (Regjistri elektronik i Lobisteve)
• Civil Society Organization Registry
• FOIA Request/Response Logs — 2018–2021
• Albanian Constitution, Electoral Code, Deputy Status Law
• Budget expenditure tables, Reserve fund tables
• Parliamentary Annual Reports 2013–2019
• Organizational chart, Code of Conduct, Media accreditation rules

372 of 392 XLSX spreadsheets were downloaded (44 MB), 837 of 885 DOCX documents were recovered (73 MB), and 25 priority PDFs/DOCs were downloaded (20 MB). Total Parliament-related data collected: approximately 237 MB.

Internal Reference

The parlament.al React JS bundle contains a hardcoded internal API reference:

http://134.0.63.165:5000/public

This is a private IP address unreachable from the public internet, confirming additional backend infrastructure beyond the Azure-hosted public API. The 134.0.x.x range is consistent with AKSHI’s own AS5576 network space (same range as e-albania.al at 134.0.39.39 and akshi.gov.al at 134.0.42.170).

Data Collected

Impact Assessment

Immediate impact: Full PII dossier on every Albanian Member of Parliament — a complete target package for social engineering, phishing, physical security threats, or political intelligence operations. The email directory alone provides a verified contact list for all 236 MPs.

Document exposure: Salary and benefits records for MPs covering 2018–2020, lobbyist registry, and four years of FOIA logs represent significant institutional transparency data — some of which may have been intended as non-public.

Systemic concern: The Parliament API has been on Azure since at least January 2022 (based on document timestamps). This exposure has persisted for at least four years. The API endpoint URL is hardcoded in a publicly served JavaScript bundle — it has been trivially discoverable by anyone who examined the frontend source during that period.