LinkedIn · Report #3151001
Previous commentor on post can still comment even after comment permission is changed to disabled
Summary
A logic error existed in LinkedIn's comment permission system that allows users who have previously commented on a post to continue posting additional comments even after the post owner disables commenting functionality. The vulnerability occurs when an account creates a post with comments enabled, another account posts a comment, and then the original poster disables comments. Users who commented before the restriction was applied retain the ability to add new comments, bypassing the intended access control mechanism.
This represents an improper access control vulnerability where the system fails to properly enforce updated permission settings. The issue affects the moderation controls that post owners rely on to manage interactions on their content.
Steps to Reproduce
- Create a post from Account A with comments enabled
- Post a comment from Account B on the post created by Account A
- Disable comments on the post through Account A's privacy settings
- Attempt to post additional comments from Account B on the same post
- Observe that Account B can still successfully post new comments despite the commenting restriction being in place
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.