X / xAI · Report #174721
View liked twits of private account via publish.twitter.com
Validstatus
mediumseverity
47upvotes
14 Nov 2016disclosed
How it was found
https://publish.twitter.com/?url=https://twitter.com/*private_account_id*/likes
POC: Private account https://twitter.com/testprivateacc1
https://publish.twitter.com/?url=https://twitter.com/testprivateacc1/likes