# Twitter Fleets API: read-only app can create fleets

Twitter Fleet API endpoints skipped OAuth scope checks, letting a read-only third-party app create and delete fleets via POST /fleets/v1/create.

- Payout: Research
- Severity: medium
- Program: Twitter
- Write-up by: RyotaK
- Disclosed: 2021-01-05
- Write-up quality: 7/10
- Original: https://blog.ryotak.net/post/twitter-privesc/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-ryotak-net-post-twitter-privesc
- Tags: area:mobile domain:api domain:mobile kind:research platform:research sev:medium tech:oauth tech:rest technique:reverse-engineering technique:source-review vuln:access-control vuln:auth-bypass vuln:privilege-escalation

**Target:** Twitter Fleet REST API (Android client endpoints)
**Root cause:** Fleet endpoints (/fleets/v1/create etc.) lacked the OAuth permission/scope check that legacy API endpoints (e.g. /1.1/statuses/update.json) enforce before processing, so read-only app tokens could perform write actions.
**Steps:**
1. Decompile Twitter for Android with apktool, dex2jar, CFR
2. `grep -r fleet` over decompiled .java files to find `/fleet/v1/user_fleets` and sibling endpoint strings
3. Authenticate twurl with a third-party app token holding only read scope
4. `twurl /1.1/statuses/update.json -X POST -d '{"status":"Test"}'` returns `Read-only application cannot POST.`
5. `twurl /fleets/v1/create -X POST -H 'Content-Type: application/json' -d '{"text":"Hey yo"}'` returns a created fleet object with fleet_id
**How found:** New feature shipped to Android; researcher decompiled the APK, grepped for 'fleet' to enumerate endpoints, then while validating API docs noticed write calls succeeded under a read-only app token — initially suspected a misconfigured app, confirmed scopes were read-only, then compared against legacy API behavior to confirm the missing check.
**Exploitation:** Any third-party app with read-only OAuth access could call Fleet write endpoints directly, creating (and per the report, deleting) fleets as the victim user without write scope.
**Insight:** When a new feature ships, decompile the client and diff its endpoints' auth behavior against the legacy API — new microservice endpoints often bypass the centralized scope middleware the old endpoints rely on.