Companies House Flaw Could Have Exposed Data of Five Million Firms
Summary
A Companies House WebFiling flaw let authenticated users potentially access other firms’ accounts and alter company details. The agency patched it after shutting down the service and says it knows of no exploitation.
Key points
- A flaw introduced in October 2025 allowed logged-in WebFiling users to access other companies’ accounts.
- The reported bypass involved selecting “file for another company,” entering its company number, then pressing the back button when prompted for an authentication code.
- Potentially accessible information included directors’ dates of birth, home addresses and email addresses across five million registered firms.
- The flaw could also have enabled unauthorized filings or changes to company details, but not changes to existing filed documents.
- Companies House said passwords and identity-verification materials such as passports were not exposed, and it knew of no access or changes through exploitation.
- The agency said records could only be viewed individually, not extracted in large volumes or accessed systematically.
- The service was shut down on Friday and the vulnerability was patched over the weekend; companies were advised to check their details and filing history.
Article Details
- Vulnerability Types
- Broken access control
- Severity
- Critical
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available