WebFiling Flaw at UK Companies House Exposed Director Data for Months

Companies House discovered an authorization-bypass vulnerability in its WebFiling service that, from an October 2025 update until detection on 13 March 2026, could let authenticated users view and potentially alter other companies' private records (including dates of birth, residential addresses, and corporate emails) and submit fraudulent filings. The portal was taken offline, remediated, and restored on 16 March; impact was limited by the requirement for valid user authentication and the inability to perform automated mass extraction, and there is no evidence that passwords, scanned identity documents, or historical filed documents were compromised.