Autodesk · Report #2968039

Insecure Direct Object Reference (IDOR) in GraphQL deleteProfileImages Mutation

Validstatus

highseverity

80upvotes

21 Feb 2025disclosed

Summary

An IDOR (Insecure Direct Object Reference) vulnerability was found on Autodesk User Profile, through the "id" parameter which could have allowed an attacker to delete another user's photo. Autodesk has fixed the vulnerability and we thank @alphahacks for reporting this issue.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original