TikTok · Report #2848610
IDOR on ads.tiktok.com Allows Unauthorized Product Addition
Validstatus
lowseverity
$500bounty
131upvotes
20 Feb 2025disclosed
Summary
An Insecure Direct Object Reference (IDOR) vulnerability was found on a TikTok Ads API, which could have resulted in the addition of arbitrary products to a user's catalog without proper authorization. We thank @p_oria for reporting this to our team.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.