IDOR may allow access to non-public photos

Summary

By adding elsewhere-discovered photo IDs for non-public photos uploaded by others to a Flickr group via an upload batch run by the attacker the attacker could gain access via their membership is that group to the third party photos.

This vulnerability allows an attacker to access any non-public photo just by knowing its ID. It also lets the attacker add any photo to a group without the owner's approval.

X (Twitter): @user_cyborg