HexBrain

LinkedIn · Report #3151001

Previous commentor on post can still comment even after comment permission is changed to disabled

Validstatus
lowseverity
112upvotes
3 Feb 2026disclosed

Summary

A logic error existed in LinkedIn's comment permission system that allows users who have previously commented on a post to continue posting additional comments even after the post owner disables commenting functionality. The vulnerability occurs when an account creates a post with comments enabled, another account posts a comment, and then the original poster disables comments. Users who commented before the restriction was applied retain the ability to add new comments, bypassing the intended access control mechanism.

This represents an improper access control vulnerability where the system fails to properly enforce updated permission settings. The issue affects the moderation controls that post owners rely on to manage interactions on their content.

Steps to Reproduce

  1. Create a post from Account A with comments enabled
  2. Post a comment from Account B on the post created by Account A
  3. Disable comments on the post through Account A's privacy settings
  4. Attempt to post additional comments from Account B on the same post
  5. Observe that Account B can still successfully post new comments despite the commenting restriction being in place

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original