TikTok · Report #1744194
Business Suite "Get Leads" Resulting in Revealing User Email & Phone
Validstatus
highseverity
52upvotes
10 Nov 2022disclosed
Summary
A vulnerability within the Business Suite settings on an Android device could have resulted in a user's email and/or phone number being revealed via the "sec_user_id" parameter if their information is sent via "Get Leads". We thank @datph4m for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.