TikTok · Report #1575560
Internal Employee informations Disclosure via TikTok Athena api
Validstatus
mediumseverity
$1,000bounty
27upvotes
20 Jul 2022disclosed
Summary
A vulnerability was found where internal employee email address could be disclosed on a TikTok Ads endpoint API by adding an "employee_email" value to the "metrics" field/array in the request body. We thank @hein_thant for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.