View thumbnail of any private video (friends or followers only) of Private/Public account
Low
T
TikTok
Submitted None
Team Summary
Official summary from TikTok
A theoretical attack scenario was found where the thumbnail of any private video could be viewed if the video's setting was "friends/followers only" (not "only me"), and if the video_id parameter was known or bruteforced. We thank @amans for reporting this to our team.
Actions:
Reported by
amans
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Privacy Violation