HexBrain

LY Corporation · Report #952095

Deleting someone else's profile image with a GraphQL query in programming education service (https://entry.line.me)

Validstatus
mediumseverity
16upvotes
18 Apr 2022disclosed

Summary

LINE entry is a service that provides programming education for children (https://entry.line.me). LINE entry provides users with the ability to add profile images. It was possible to delete other people's profile images or thumbnails using a GraphQL query.

How it was found

The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original