Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net

Summary

Summary

A vulnerability in Pixiv.net's messaging system allows any user to send messages to another user who has disabled their inbox (i.e., turned off messages from unknown users). By manipulating the id parameter in the message-sending POST request, an attacker can bypass inbox privacy settings, sending unauthorized messages to users who have opted out. Additionally, the lack of rate limiting or duplicate request validation allows attackers to spam users by repeatedly sending the same or modified requests, exacerbating the potential for harassment.

This undermines user trust in Pixiv’s privacy controls and could lead to significant abuse.