A Beam Living GraphQL query accepted any email address and returned that applicant's SSN digits, date of birth, address and credit score

Sources: primary, discussion
Summary: The reporter found a GraphQL query on the Beam Living rental platform that took an applicant email address from the request body and returned that applicant's social security number digits, date of birth, address, phone number, IP address and credit score without checking the session. The write-up names five Beam Living communities sharing the portal, 8 Spruce, StuyTown, Peter Cooper Village, Kips Bay Court and Parker Towers, so any applicant record still held in it was reachable from an email address alone. The reporter retested on 2026-07-09 and found it patched, and the write-up was published on 2026-08-24.
Why it matters: The query took the user identifier from the request body instead of the session, a pattern any GraphQL API can carry, and the operator told the reporter there was no issue while silently patching it.