TikTok · Report #1555376
IDOR on Tagged People
Validstatus
mediumseverity
63upvotes
20 Sept 2022disclosed
Summary
An Insecure Direct Object Reference (IDOR) vulnerability was found on the TikTok app where a user was able to tag any other user on videos that don't belong to them. We thank @apapedulimu for reporting this to our team.
Write-Up: https://apapedulimu.click/tag-myself-in-your-favorite-tiktok-artist-video-idor/
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.