[URGENT] Opportunity to publish tweets on any twitters account

Summary

The reporter discovered a flaw in the handling of Twitter Ads Studio requests which allowed an attacker to tweet as any user. By sharing media with a victim user and then modifying the post request with the victim's account ID the media in question would be posted from the victim's account. This bug was patched immediately after being triaged and no evidence was found of the flaw being exploited by anyone other than the reporter.

Write-up of the vulnerability here: https://medium.com/@kedrisec/publish-tweets-by-any-other-user-6c9d892708e3