Valve · Report #357952
Deleting other people's comments on ModeratorMessages
Validstatus
lowseverity
$500bounty
25upvotes
23 Jan 2019disclosed
Summary
Due to a missing permissions check, anyone could delete a comment on a community moderator message knowing the unique comment GID and the SteamID of the message receiver. The endpoint has been corrected to verify the correct permissions.
You were able to delete others people's comments on moderator messages.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.