LY Corporation · Report #952095
Deleting someone else's profile image with a GraphQL query in programming education service (https://entry.line.me)
Validstatus
mediumseverity
16upvotes
18 Apr 2022disclosed
Summary
LINE entry is a service that provides programming education for children (https://entry.line.me). LINE entry provides users with the ability to add profile images. It was possible to delete other people's profile images or thumbnails using a GraphQL query.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.