TikTok · Report #1783001
Ability to change permissions across seller platform
Validstatus
mediumseverity
47upvotes
6 Dec 2022disclosed
Summary
An Insecure Direct Object Reference (IDOR) vulnerability was found on the "Post" request on a TikTok Seller endpoint, which could have resulted in any user having the ability to change the "Finance Specialist" role permission. We thank @imran_nisar for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.