This is a bug I reported to Google via Google's Vulnerability Rewards Program on Mar 22, 2019.

Below is an intact reproduction of the report sent to Google (I formatted several parts so they are better looking here, I could only send plain text to Google, and I censored some parts):

Description

This is a vulnerability report about a product (the Community Console: https://support.google.com/communities/answer/9026531?hl=en) that is only available to Product Experts (volunteers outside Google who answer questions in the Google Forums and are recognised by Google: https://productexperts.withgoogle.com/) and some Googlers. Therefore, before being able to reproduce the problem, maybe you have to ask authorization to access the Community Console.

Steps to reproduce:

1. If the API has not changed its behaviour, run the following CURL command which will make a request to the API and will get a forum thread data (there's no need to send any cookies for it to succeed):

curl 'https://support.google.com/s/community/api/ViewThread?authuser=0' -H 'origin: https://support.google.com' -H 'accept-encoding: gzip, deflate, br' -H 'accept-language: en-US,en;q=0.9,es;q=0.8,ca;q=0.7,fr;q=0.6' -H 'user-agent: Mozilla/5.0 (X11; CrOS x86_64 11316.165.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.122 Safari/537.36' -H 'content-type: text/plain; charset=utf-8' -H 'accept: */*' -H 'referer: https://support.google.com/s/community/forum/697265/thread/2517326' -H 'authority: support.google.com' --data-binary '{"1":"697265","2":"2517326","3":{"1":{"2":0},"2":{"1":1},"3":true,"5":true,"10":true,"16":true}}' --compressed

2. In that obfuscated JSON response, you'll be able to see "83.37.193.225" somewhere in there, the IP address with which I posted the first message of the thread.

If the previous API request didn't work well because the API changed its behaviour, these are the steps to follow:

1. Open a Chrome tab and open the "Network" tab in the Developer Tools.
2. Browse to https://support.google.com/s/community/forum/697265/thread/2517326 (again, if you don't have permission to access this page you may be redirected to https://support.google.com).
3. In the network tab, search for a request called "ViewThread" (https://support.google.com/s/community/api/ViewThread). The response from the server for that petition is the data corresponding to the thread being opened.
4. You'll be able to see my IP address in there, as I explained before.
5. If you try to replay that request shown on Chrome by copying the request as CURL and removing all the (authentication) cookies, you'll continue to receive a response with the thread data, so technically if some user outside the Product Experts circle knows of the API endpoint and how it works, they will be able to obtain the IP addresses, and that's why I shared with you the CURL request in the first place, because it is easier to reproduce it that way.

Browser/OS: Chrome OS 72.0.3626.122

Attack scenario

Any of the [REDACTED] Product Experts who have access to the Community Console can take advantage of this vulnerability easily by looking at the response that the API returns when opening a thread, and anyone who is aware of this issue and knows how the API works can exploit it. This could allow people to track the posters in the forum by their IP and also approximately geolocate them.

Although the forums are public (for example https://support.google.com/chrome/community?hl=en), the Community Console is a tool exclusive for Product Experts and Googlers to answer questions faster and better (and I could only see that the vulnerability exists in the Community Console, not on the public forums). With that being said, I would like to observe that if an attacker knew the API endpoint and how it works (maybe because some Product Expert has told them), it would be very easy to make valid requests, because all the threads are public, and this way an attacker would be able to get the ID of each thread and pass it as a parameter to the API request in order to get the IP of the original poster in each thread.

In the worst case scenario, someone could sue Google because you're revealing the IP addresses you collect against what you state in your privacy policy (https://policies.google.com/privacy?hl=en-US#infosharing), because you didn't ask the user for consent to give it to the Product Experts (who are not Google employees), and I don't think it falls under the "legal reasons" category nor the other ones.