Information Disclosure of Advertiser Account on TikTok Ads Portal

Summary

In the TikTok Ads portal, if both invited Ad Accounts are part of the same business group, an exposed endpoint could potentially be exploited to view email address, phone number, company, and name of the Ad Account owner. We thank @emanuelharijanto for reporting this to our team and confirming the resolution!

I was able to find an endpoint that would leak advertiser account information by simply changing the 'aadvid' parameter. The leaked information are Email, name, qualification_url_secret, company, phone number, contact email, address and etc. There are certain conditions that needs to be fulfilled in order to exploit this vulnerability.