TikTok · Report #1793940
Any user can vote on `Friend Only` video pull
Validstatus
lowseverity
27upvotes
27 Jan 2023disclosed
Summary
A vulnerability was found where if a user knows the value of the "vote_id" parameter for a poll sticker attached to any TikTok video, they can participate in the poll even if it was set to "Friends Only". We thank @mrhavit for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.