HexBrain

X / xAI · Report #174721

View liked twits of private account via publish.twitter.com

Validstatus
mediumseverity
47upvotes
14 Nov 2016disclosed

How it was found

https://publish.twitter.com/?url=https://twitter.com/*private_account_id*/likes

POC: Private account https://twitter.com/testprivateacc1

https://publish.twitter.com/?url=https://twitter.com/testprivateacc1/likes

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original