A critical vulnerability has been found in a web application of Companies House, the government agency responsible for maintaining the public register of companies in the United Kingdom. According to Tax Policy Associates, the security hole was discovered by John Hewitt of Ghost Mail on March 12, but it existed for several months before a patch was rolled out. Hewitt found that any logged-in user could access other companies’ accounts on the Companies House platform. The attacker could have gained access to the non-public information of five million registered firms, including directors’ dates of birth, home addresses and email addresses. In addition, an attacker could have changed a company’s details and could have submitted unauthorized filings. While the vulnerability could only be…