Mail.ru: Public available Sensitive Information about drivers

Domain, site, application API for client app Citimobil https://c-api.city-mobil.ru/ Version 4.33.0 (and others) Testing environment Device on any OS with internet connection Any software to send https requests Steps to reproduce Send POST request to url "https://c-api.city-mobil.ru/getdrivers" with data: { "latitude": LAT, "longitude": LON, "limit": 10, "method": "getdrivers", "radius": 5, "tariff_group": [ 4 ], "ver": "4.33.0" } Actual results Response will contain GEO and BUSINESS data about 10 drivers nearest to the requested point - their positions, color codes, directions and car types. Iterating over different city locations you can get the whole information about company fleet. The response will proceed without any authentication. So the sensitive real-time information about company fleet is public available. Expected results, security impact description and recommendations The authentication procedure for this data should be required PoC, exploit code, screenshots, video, references, additional resources Request: curl -X POST --data '{ "latitude": 55.7, "limit": 10, "longitude": 37.6, "method": "getdrivers", "radius": 5, "tariff_group": [4], "ver": "4.33.0" }' https://c-api.city-mobil.ru/getdrivers Response: ~~~...