LinkedIn · Report #1862677
Attacker can unpin posts from companies he's not part of.
Validstatus
lowseverity
20upvotes
12 May 2023disclosed
Summary
The researcher found an Insecure Direct Object Reference (IDOR) to unpin any company's post on LinkedIn, without having the required permissions.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.