IDOR to make someone attend or leave an event

Summary

An Insecure Direct Object Reference (IDOR) vulnerability exists in LinkedIn's event attendance functionality. The vulnerability allows an unauthorized attacker to manipulate event attendance by modifying the fsd_profile parameter in POST requests to the voyagerScheduledcontentDashViewerStates API endpoint. An attacker can force any LinkedIn user to appear as an attendee of any event without sending or requiring an invitation, remove legitimate attendees from events, or evict attendees preventing them from rejoining. The fsd_profile identifier can be obtained from any user's public LinkedIn profile page source. This issue has now been fixed.