Snapchat · Report #1103448
Organization Members in Snap Kit may Deactivate Apps
Validstatus
lowseverity
26upvotes
26 Aug 2021disclosed
Summary
A member of a Snap Kit organization may deactivate an organization's app, by performing a POST request to https://kit.snapchat.com/api/portal/graphql. even if they are not authorized to do so. This allows a malicious organization member to deactivate the apps of an organization, even if they are not an admin.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.