TikTok · Report #3012526
Chained Broken Access Control in TikTok Live Backstage Enables Full Control of Public Leaderboard Activities
Validstatus
mediumseverity
89upvotes
11 Sept 2025disclosed
Summary
A broken access control vulnerability in TikTok Live Backstage allowed low-privilege users (group members and group leaders) to gain unauthorized control over public leaderboard activities belonging to other organizations.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.