HexBrain

Reddit · Report #1543770

Moderators can send messages to users from banned subreddits via `oauth.reddit.com/api/mod/conversations`

Validstatus
lowseverity
$100bounty
19upvotes
4 Jul 2022disclosed

How it was found

Summary:

It is possible for moderators to send messages to users from a banned subreddit.

I assume this is not intended considering that when trying to send a message as a banned subreddit via reddit.com/message/compose (from field) you get a 200 response but the message is never delivered to the recipient.

Steps To Reproduce:

  1. While in mod.reddit.com/mail/create, select a banned subreddit from the dropdown menu.
  2. Fill in all other fields and send the message.

Impact

Moderators can "officially" communicate with users even after the subreddit gets banned. This can be used to organize a new subreddit to migrate to in order to circumvent the ban.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original