Feeld: Security flaws could expose messages and private photos

A security firm found that flaws in Feeld could let outsiders read chats and open private photos and videos. Feeld says it fixed the issues in 2024 and saw no evidence of misuse.

What happened

In March 2024 the London-based security firm Fortbridge reported several vulnerabilities to Feeld, a dating app for alternative relationships. Most of them involved broken access controls. According to Fortbridge, an attacker who had another user's "stream user ID" could read that user's messages and open shared photos and videos without logging in, including time-limited and "play-once" media. The attacker could also edit, delete or recover messages, change another person's profile, including their sexuality, and see other people's matches. Feeld told The Guardian it fixed the issues by 28 May 2024. It said it had seen no evidence that user data was accessed, so it did not report the matter to the UK regulator, the ICO. Fortbridge published its findings in September 2024.

What is documented

• Fortbridge: eight vulnerabilities; its timeline lists disclosure to Feeld on 8 March 2024 and publication on 10 September 2024.
• The Guardian: Feeld says it investigated the issues from 3 March and fixed them by 28 May 2024, and had seen no evidence of a breach; the ICO said it had not received reports of a breach.
• The Guardian: Fortbridge said the flaws could be exploited by someone with "basic technical knowledge".

What has not been established

• Whether anyone actually exploited the flaws before they were fixed.
• How long the flaws existed before March 2024.
• No regulator decision is known from these sources.
• The two sources give different March dates (3 and 8 March) for when Feeld was told.

What this means for you

1. Do not share intimate images you could not accept seeing spread, even with "view once" features.
2. Keep the app updated so that you get security fixes.
3. Avoid sharing details in chats that could identify you, such as your workplace or address.