It is a vulnerability, but exploiting that vulnerability is not generally considered by security experts to be “hacking” in the usual meaning of that term in academic settings. Using an open or exposed API, even one with a sign that says “don’t abuse me”, is generally not considered hacking.
I am a security professional. I would personally not care less to make the distinction, as both are very generic terms that are used very liberally in the industry.
So I don’t see any reason not to call this hacking. This was not an intended feature. It was a gap, which has been used to perform things that the application writer did not intended (not in this form). If fits with the definition of hacking as far as I can tell. In any case, this is not an academic discussion, it is a security advisory or an article that talks about it.
I’m not someone who works on the practical side of security, but as a computer scientist, I do not agree that it is “hacking”. That contradicts my understanding of “hack” versus other types of exploits, but you are correct that the distinction is generally not that important. A security problem is a security problem regardless what it’s called
I’m not talking out of my arse here either. I don’t work in security specifically but I’ve got a CS degree as well and it contradicts my understanding of how those terms are generally used. This is an open API endpoint, equivalent to leaving the garage door open.
But the distinction is usually unimportant. A security hole is a security hole regardless of what you call it.
To build on you analogy: if you left your garage door open and people came in and started taking your things, is that not stealing?
