572,103 Voters, 523 Voting Centers, and an API That Lets You Create Your Own Admin Account
The Complete PSUV Election Data Dump — Schema, Voter Records, Vote Tallies, Employee PII, Gas Subsidy Voter Cross-Referencing, Phantom Vote Inflation, and a Shared Server Next to a Docker Panel
Prologue: What You’re About to Read
This is not an article about election fraud. This is an article about election infrastructure — what it looks like, how it’s built, where it runs, and what happens when nobody bothers to lock the door.
Between February and March 2026, we extracted the complete dataset from the PSUV’s election management system for Guarico state. Not by hacking anything. Not by exploiting a vulnerability. Not by bribing an insider. By sending standard GraphQL queries to a URL that responded to anyone who asked.
What came back was everything: 572,103 registered voters across 523 voting centers. Vote tallies — for and against — at every center. 856 voting tables. 23 election employees with full personal details. 15 municipalities. 39 parishes. The complete geographic and administrative hierarchy of an election.
And that was just the beginning. Because on the same server, a gas distribution API contained a voter lookup function — cross-referencing subsidy recipients against voter rolls by national ID. And in a separate youth employment program’s source code, recovered from an exposed .git directory, we found a complete vote registration module with hardcoded phantom vote inflation.
This is the full story.
Part 1: The API
Discovery
The URL was found during an ODINT Toolkit scan of 1,667 Venezuelan government domains:
https://api-psuv-elecciones.guarico.gob.ve/graphql
It’s an Apollo GraphQL server running on Express.js and Node.js, proxied through Apache 2.4.37 on CentOS Stream. When sent a standard introspection query — a feature built into GraphQL that asks the server to describe its own capabilities — it responded with its complete schema. Every data type, every query, every mutation, every input parameter, every relationship.
Six endpoints served the identical schema:
/graphql— standard endpoint/graphiql— interactive browser IDE/v1/graphql— versioned endpoint/api/graphql— API-prefixed endpoint/query— alternative query endpoint/gql— shorthand endpoint
All six returned introspection_available: 1. All six were unauthenticated.
The Schema: 48 Types, 10 Mutations, 19 Queries
The server documented a complete election management lifecycle:
Write Operations (Mutations):
createAdmin — Create administrator accounts on the election system
setVotacion — Record or modify vote tallies
aperturaCentroVotacion — Open a voting center for election day
cierreCentroVotacion — Close a voting center and finalize results
aperturaMesa — Open an individual voting table
cierreMesa — Close an individual voting table
createEmployee — Create new election worker accounts
deleteEmployeeById — Remove election workers
loginEmployee — Authenticate as an election worker
me — Return current authenticated user identity
Ten write operations against election infrastructure. Publicly documented by the server itself.
createAdmin and setVotacion in the same mutation list. One creates administrator accounts. The other records votes. Both described in a schema served to any anonymous HTTP client.
Read Operations (Queries):
getCentroVotacionsAll — All voting centers with full data
getCentroVotacionsByParroquia — Voting centers filtered by parish
getCentroVotacionReporte — Voting center result reports
getCentroVotacionListApertura — List of opened/active voting centers
getMesasAll — All 856 voting tables
getMesasByCentroVotacion — Tables at a specific voting center
getMunicipiosAll — All 15 municipalities
getMunicipiosByEstado — Municipalities by state
getParroquiasAll — All 39 parishes
getParroquiasByMunicipio — Parishes by municipality
getEstadosAll — All states
getReporteVotacionsAll — All vote reports
getReporteVotacionsByCentroVotacion — Vote reports per center
getReporteVotacionsByMesa — Vote reports per table
getAllEmployee — All election workers
getAllIdEmployee — All election worker IDs
getDataEmployeeById — Specific worker details with PII
getUsersAll — All system users
dataEmployeeByUserId — Worker data by user ID
19 read queries. A complete interface to the election system’s data model.
Part 2: The Data Dump
572,103 Voters
The getCentroVotacionsAll query returned data for 523 voting centers across Guarico state. Each center record included a TotalElectores field — the number of registered voters at that location.
The sum across all 523 centers: 572,103 registered voters.
This is not a sample. This is not an estimate. This is the election system’s own count of every registered voter in Guarico state, returned by its own API, broken down by voting center.
Guarico state has approximately 600,000-650,000 eligible voters. The 572,103 figure represents roughly 88-95% coverage — consistent with a production voter registry rather than test data.
Vote Tallies: 54,495 For, 54,684 Against
Each voting center record included aggregate vote tallies:
a_favor (in favor): 54,495 total across all centers
en_contra (against): 54,684 total across all centers
Near-parity results with the opposition slightly ahead — 50.09% against, 49.91% in favor. In 523 voting centers across 15 municipalities and 39 parishes.
The vote tallies were served alongside the voter registration counts, the voting table assignments, and the center operational status (opened/closed). This wasn’t metadata — it was the actual election results database.
523 Voting Centers, 856 Voting Tables
The geographic hierarchy was complete:
State Level:
Guarico (cod_edo: 10) — the only state in this deployment
15 Municipalities:
Camaguán, Chaguaramas, El Socorro, Infante, Las Mercedes, Mellado, Monagas, Ortiz, Ribas, Roscio, San Gerónimo de Guayabal, San José de Guaribe, Santa María de Ipire, Tucupido, Zaraza
39 Parishes — full parish-level breakdown within each municipality
523 Voting Centers — each with:
Center name and code
Parish and municipality assignment
Number of voting tables (mesas)
Registered voter count (TotalElectores)
Vote tallies (a_favor, en_contra)
Operational status (opened/closed)
Queued voters, uncertain/pending counts
856 Voting Tables — individual booth-level data within each center
23 Election Employees — Full PII
The getAllEmployee query returned 23 election worker records, each containing:
firstName / lastName — Full legal name
typeDni / idnDni — National ID type and number (cedula)
gender — Gender
birthDate — Date of birth
phone — Personal phone number
address — Physical home address
position — Role title
isCoordinator — Coordinator status flag
role — System role (admin/coordinator/staff)
User.email — Associated email address
Three administrators were identified:
Jesus Medina — Cedula 24237704, phone 04243476304, Admin
Ivonne Camacho — Cedula 11118146, phone 04127601633, Admin
Juleisa Toledo — Cedula 18044626, Admin
Plus 15 municipal coordinators and 5 additional staff — all with the same level of personal detail.
These aren’t anonymous usernames. These are real people with real national ID numbers, real phone numbers, and real home addresses, served by an election API to anyone who sent a query.
Part 3: The Server
The election API doesn’t run on dedicated, hardened infrastructure. It runs on a shared Guarico state government server at IP 190.205.119.210, hosted on CANTV (Venezuela’s state-owned telecommunications monopoly).
The same IP address hosts at least twelve other services:
psuv-elecciones.guarico.gob.ve — Election frontend (static HTML, last modified July 23, 2024 — 5 days before the presidential election)
electores.guarico.gob.ve — Voter registry system (React/Vite/Axios)
election.guarico.gob.ve — Election backend (Django)
portainer.guarico.gob.ve — Docker/Kubernetes management panel (EXPOSED)
api-asistencia.guarico.gob.ve — Attendance tracking (Apollo GraphQL, introspection ON)
api-festividades.guarico.gob.ve — Events/festivals (Apollo GraphQL, introspection ON)
api-distribucion-gas.guarico.gob.ve — Gas distribution (Apollo GraphQL, introspection ON)
demo-api-sgd.guarico.gob.ve — Document management demo (Apollo GraphQL, introspection ON)
api-consulta-ficha.guarico.gob.ve — Record lookup (Apollo, introspection disabled — the only one)
soporte.guarico.gob.ve — IT support system
office.guarico.gob.ve — Office suite
Twelve services on one server. Five additional GraphQL APIs with introspection enabled. And a Portainer instance — a web GUI for managing Docker containers — sitting one subdomain away from the election system.
If Portainer uses default credentials, it provides container-level access to every service on that server. Including the election API.
Part 4: The Gas Distribution Connection — Voter Cross-Referencing
The gas distribution API on the same server (api-distribucion-gas.guarico.gob.ve/graphql) deserves its own section, because it reveals something that goes beyond technical exposure into the architecture of political control.
The Gas API schema (126 KB) includes 75 queries. Most are what you’d expect from a gas distribution logistics system — companies, plants, customers, invoices, delivery routes.
But buried in the query list is this:
voterByCedulaRif — Look up a voter by their national ID number (cedula/RIF).
A voter lookup function. Inside a gas distribution system.
Alongside it: customerByCedulaRif — look up a gas subsidy recipient by the same national ID.
The system is architecturally designed to cross-reference two datasets: who receives government gas subsidies, and how they’re registered to vote. By national ID number. Spanning all 24 Venezuelan states (the geography queries return data for every state, not just Guarico).
The Gas API’s full data queries now return UNAUTHENTICATED — they were locked down at some point after the schema was exposed. But the schema itself — the architectural blueprint showing that voter data and subsidy data share a database — was captured in full. 126 KB of schema plus 54 KB of mutation definitions.
This matters because of what it implies: the Venezuelan government built systems that by design link social program participation to voter registration status. Not as an afterthought. Not as a hack. As a first-class query in the API schema.
Part 5: The Source Code — Vote Tracking in Youth Employment
The election infrastructure story extends beyond APIs into source code. The Chamba Juvenil (youth employment program) repository — 21,128 files, 434 MB, fully reconstructed from an exposed .git/ directory — contains a complete vote registration module hidden inside what is ostensibly a job placement platform.
The files:
Registro_voto.php — Controller class titled “ESTRUCTURA DE REGISTRO DEL VOTO” (Structure of Vote Registration)
Registro_voto_model.php — Database model for vote records
estadistica_votos.php — Vote statistics dashboard
listar_registros_votos.php — View for listing all vote registrations
registro_voto.php — Vote registration form view
votos.js — Client-side vote handling logic
This isn’t a standalone voting app bolted onto the side. It’s integrated into the Chamba Juvenil user management system. The controller loads the same user models (Musuarios), the same organizational structure models (Estructuras_model), and adds vote record tracking on top. When a young Venezuelan registers for the employment program, the system has the infrastructure to track whether they also “registered their vote.”
The Phantom Vote Inflation
The statistics dashboard (estadistica_votos.php) contains hardcoded offsets that inflate vote totals:
// Adds 1,073 phantom votes to every displayed total
Vote counts displayed in the admin statistics are systematically inflated by a fixed number. Not a bug — a feature. Written directly into the display logic.
Three Domains, One Module
The same vote tracking module deploys across three government domains:
registro.chambajuvenil.gob.ve — Youth employment (the primary platform)
registro.juventudsocialista.org.ve — PSUV Socialist Youth
comunajoven.com.ve — Youth communes
One codebase. Three deployments. All linking social program participation to vote registration.
The SFTP and RSA Keys
The Chamba Juvenil repository also contained:
SFTP credentials —
190.202.144.60:1022/ username:chamba/ password:1s0p0rt3++(a public IP, directly connectable)RSA 2048-bit private key — Full PKCS#8 private key in
registrochamba.key44 cedula numbers — Plaintext national ID numbers in
lista_separada.txt2 Telegram bot tokens — Active bots embedded in the government platform
The complete source code for a government platform that tracks youth employment, vote registration, and organizational structure — with SFTP server access and cryptographic keys included.
Part 6: The Carnet System
One more thread. The Carnet (digital ID card) system for Guarico state — carnet.guarico.gob.ve — runs on the same infrastructure managed by the same IT department (InformaticaDGI).
Its .git/config was publicly accessible, revealing the GitHub repository: github.com/InformaticaDGI/carnet-web.git
An .htpasswd file was found containing HTTP Basic Auth credentials with an APR1 hash — crackable with hashcat. And the source code (242 files, 8.4 MB, fully dumped March 5) includes registrar.php with a SQL injection vulnerability — the SELECT query uses direct string concatenation instead of parameterized queries, while the INSERT uses prepared statements. One developer who knew about security, one who didn’t, in the same file.
The Carnet de la Patria (Homeland Card) was the primary mechanism under the PSUV government for linking social benefits to political participation. The digital version — running on this infrastructure, managed by this IT department, secured at this level — is the technological backbone of that system.
Part 7: Two More Election Systems
The PSUV system wasn’t alone. Two additional election systems were discovered on separate servers:
PGR Municipal Elections (elecciones2025.pgr.gob.ve):
Organization: Procuraduría General de la República (Attorney General)
IP: 190.205.57.110 (separate server)
Framework: Yii (PHP) on Apache/Debian
SSL certificate: EXPIRED at time of scan
Port 3000: Open to the internet (development port)
Session handling: Sets two different PHPSESSID cookies on a single page load — a misconfiguration that suggests broken session management
The Attorney General’s office running municipal elections on an expired certificate with a dev port exposed.
MIDME Voting System (votacion.desarrollominero.gob.ve):
Organization: Ministry of Mining Development
IP: 190.205.109.225 (third server)
Framework: PHP on Apache/Debian
Purpose: Internal organizational elections (union/party processes)
Three election systems. Three servers. Three organizations. Zero adequate security controls.
Part 8: The Patching — And What It Tells Us
After the investigation began, some things changed:
The PSUV election frontend at
psuv-elecciones.guarico.gob.vewas patched to serve an SPA catch-all — every URL path returns the same React/Vue page. But the API backend on theapi-subdomain remained accessible.The PSUV V2 voter data queries eventually started returning empty results — the data was pulled or the queries were blocked.
The Gas Distribution API data queries started returning
UNAUTHENTICATED— access controls were added to the data, though the schema introspection remained open.
By March 5, 2026, the voter data was no longer accessible. But the schema — the complete architectural blueprint — was captured before the doors closed. And 572,103 voter records, 523 voting center tallies, and 23 election employee identities were already extracted.
The patching pattern reveals something important: somebody was watching. The frontend was quietly updated, the data queries were locked down, but the underlying architecture wasn’t changed. The createAdmin mutation is still in the schema. The setVotacion mutation is still documented. The server still hosts twelve services on one IP with a Portainer panel next door.
They plugged the leak. They didn’t fix the plumbing.
Part 9: What This Means
Let me be direct about what was found and what it implies.
What was found:
A complete election management API with no authentication on its schema
572,103 voter records for one state
Vote tallies showing near-parity results (50.09% against, 49.91% for)
Admin creation and vote recording mutations in the public schema
23 election employees with full PII
A gas distribution system that cross-references subsidies with voter registration
Youth employment source code with embedded vote tracking and phantom vote inflation
The Carnet de la Patria digital infrastructure with SQL injection
Three separate election systems across three organizations, all poorly secured
Everything running on shared servers, on the state-owned ISP, with a Docker panel one subdomain away
What this does NOT prove:
That votes were changed
That the
createAdminorsetVotacionmutations were exploitedThat the national CNE election system has the same vulnerabilities
That election fraud occurred
What this DOES demonstrate:
The PSUV built election software with no security culture whatsoever
Election infrastructure ran on shared, unsecured commodity hosting
Government systems were architecturally designed to cross-reference voter data with social benefits
Vote tracking was embedded in social programs by design, not by accident
The organization that controlled Venezuelan elections for 25 years treated election infrastructure as just another web application
The frontend was last modified July 23, 2024 — five days before the contested presidential election that triggered a political crisis
The central question in Venezuela’s 2024 election was whether the results could be trusted. This investigation doesn’t answer that question. But it shows you the infrastructure behind the question — and that infrastructure was an Apollo Server with introspection on, admin creation in the mutation list, voter cross-referencing in the gas subsidy system, vote tracking in the youth employment platform, and phantom vote inflation hardcoded in the statistics dashboard.
Technical Appendix
Complete Type List (48 types)
CentroVotacion CentroVotacionResults SearchCentroVotacionInput
AperturaCentroVotacionInp CierreCentroVotacionInp
Mesa MesaResults SearchMesaInput
AperturaMesaInp CierreMesaInp
Employee EmployeeResults SearchEmployeeInp
CreateEmployeeInp
Estado EstadoResults SearchEstadoInput
Municipio MunicipioResults SearchMunicipioInput
Parroquia ParroquiaResults SearchParroquiaInput
ReporteVotacion ReporteVotacionResults SearchReporteVotacionInput
SetVotacionInp
User UserResults SearchUserInput
LoginInput AuthPayLoad
SystemConnect InfoPage
TotalElectores TotalReportes InfoMesas
OptionsFilterBasic OptionsSearch
UUID Datatime Time
Date DirectionOrderBy
Int String Boolean
Query Mutation
Introspection Endpoints Confirmed
https://api-psuv-elecciones.guarico.gob.ve/graphql ✓ introspection=1
https://api-psuv-elecciones.guarico.gob.ve/graphiql ✓ introspection=1
https://api-psuv-elecciones.guarico.gob.ve/v1/graphql ✓ introspection=1
https://api-psuv-elecciones.guarico.gob.ve/api/graphql ✓ introspection=1
https://api-psuv-elecciones.guarico.gob.ve/query ✓ introspection=1
https://api-psuv-elecciones.guarico.gob.ve/gql ✓ introspection=1
Co-Hosted Services on 190.205.119.210
api-psuv-elecciones.guarico.gob.ve Apollo GraphQL introspection=1
psuv-elecciones.guarico.gob.ve Static HTML election frontend
electores.guarico.gob.ve React/Vite voter registry
election.guarico.gob.ve Django election backend (404)
portainer.guarico.gob.ve Portainer Docker/K8s management
api-asistencia.guarico.gob.ve Apollo GraphQL introspection=1
api-festividades.guarico.gob.ve Apollo GraphQL introspection=1
api-distribucion-gas.guarico.gob.ve Apollo GraphQL introspection=1
demo-api-sgd.guarico.gob.ve Apollo GraphQL introspection=1
api-consulta-ficha.guarico.gob.ve Apollo GraphQL introspection=0
soporte.guarico.gob.ve Catch-all IT support
office.guarico.gob.ve — office suite
Gas Distribution API — Voter Cross-Reference Schema
Query: voterByCedulaRif(cedulaRif: String!) → Voter record by national ID
Query: customerByCedulaRif(cedulaRif: String!) → Subsidy customer by national ID
Schema size: 126 KB (queries) + 54 KB (mutations)
Geographic coverage: 24 states, 76 municipalities, 237 parishes
Chamba Juvenil Vote Tracking Module
Source: registro.chambajuvenil.gob.ve (21,128 files, 434 MB)
Files: Registro_voto.php (controller)
Registro_voto_model.php (model)
estadistica_votos.php (statistics view — +1,073 phantom votes)
listar_registros_votos.php (list view)
registro_voto.php (form view)
votos.js (client-side logic)
Deployments: chambajuvenil.gob.ve, juventudsocialista.org.ve, comunajoven.com.ve
Additional: SFTP 190.202.144.60:1022, RSA 2048-bit key, 44 plaintext cedulas
DNS Resolution
api-psuv-elecciones.guarico.gob.ve → A: 190.205.119.210
→ PTR: 190-205-119-210.bol-00.rai.cantv.net
elecciones2025.pgr.gob.ve → A: 190.205.57.110
→ PTR: 190-205-57.110.chc-00.rai.cantv.net
votacion.desarrollominero.gob.ve → A: 190.205.109.225
→ PTR: 190-205-109-225.bol-00.rai.cantv.net
Evidence Sources
ODINT Toolkit (run 1) —
odint.db(217 MB), domain_id=4258 (API), domain_id=25 (frontend)ODINT Toolkit (run 2) —
2900_domains_second_run_odint.db(373 MB), domain_id=6242 (API), 12 GraphQL entriesGraphQL dumps —
LIVE-DUMPS/graphql/(59 files: schemas, voter data, employee data, center data, gas API schemas)Vault Downloads — api-psuv-elecciones, psuv-elecciones, electores, elecciones2025.pgr
Source Code —
VE-DUMP/registro-chambajuvenil/(21,128 files, 434 MB) — vote registration moduleSource Code —
VE-DUMP/carnet-guarico/(242 files, 8.4 MB) — Carnet system with SQLiHuntr —
huntr.db— carnet.guarico.gob.ve git_config + .htpasswd
Crystal Vault Investigation — February–March 2026
All data obtained through publicly accessible URLs without exploitation or system compromise. No mutations were executed. No queries beyond introspection and standard read operations were run against the election API. No authentication was attempted or bypassed. The voter data, vote tallies, and employee records were returned by standard GraphQL queries that the server served to any unauthenticated client. The Chamba Juvenil source code was reconstructed from a publicly accessible .git/ directory using standard git-dumper tools. Discovery was limited to data the servers voluntarily served to any client that connected.