TikTok · Report #1733627
IDOR for changing privacy settings on any memories
Validstatus
highseverity
123upvotes
27 Jan 2023disclosed
Summary
An Insecure Direct Object Reference (IDOR) vulnerability was found within TikTok Now on Android, which would have allowed any user to change the "Who Can View" privacy setting for another users' Memory. We thank @mrhavit for reporting this to the team.
https://medium.com/@mrhavit/how-i-found-an-insecure-direct-object-reference-in-tiktok-c7303addf223
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.