Summary

Multiple vulnerabilities like Insecure Direct Object Reference (IDOR), Cross-Site Request Forgery (CSRF), XSS were found that could have resulted in account takeover on the TikTok SMB subdomain. First, an Insecure Direct Object Reference (IDOR) was found, where a missing authorization check could allow an attacker to modify the details of another user. Second, a Cross-Site Request Forgery (CSRF) was found in which an attacker could takeover an account by sending a malicious link, which if clicked by another user could be used to modify that user's account's email address. We thank @lu3ky-13 for reporting this to our team and confirming its resolution.

I have found Multiple account takeovers in the TikTok SMB subdomain

first; just changed u_id=1000 to any u_id users and you can access the account and you can change email name logo users 0-click second: it's CSRF TO XSS and to account takeover no have CSRF protect

I add this to Impact

Impact 1 an attacker can take over an account with 0 clicks from IDOR 2 an attacker can add payload XSS in profile to any users 3 the profile not protected to CSRF TOKEN and an attacker can from csrf can change data profile like name and email or add payload XSS 4 both vulnerability an attacker can use to account takeover

https://twitter.com/lu3ky13