TikTok · Report #1475520
IDOR delete any Tickets on ads.tiktok.com
Validstatus
highseverity
216upvotes
2 Mar 2022disclosed
Summary
An IDOR (Insecure Direct Object Reference) vulnerability was found on TikTok ads, through the "draft_order_id" parameter which could have allowed an attacker to delete the support tickets of other users. We thank @datph4m for reporting this to our team and confirming its resolution.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.