Cross-Tenant IDOR ( graphql `AddRulesToPixelEvents` query ) allowing to add, update, and delete rules of any Pixel events on the platform

Summary

Due to an Insecure Direct Object Reference (IDOR) vulnerability, an attacker could have potentially added, deleted, or updated rules for other users' pixel events in the TikTok ads portal. We thank @bubbounty for reporting this to our team and confirming the resolution.

This report is one of my firsts on the TikTok Ads portal

The Pixel events usedd by the campaigns created by the advertiser are mainly managed through GraphQl requests.

Through a single request the advertiser can Add and/or Modify and/or Delete Pixel events. There were some IDORs weaknesses through this requests allowing to a bad advertiser to perform all these actions on any other Pixel Events of any other Adversiters.