# How I was able to change Reddit acquired Dubsmash’s music library sound tracks.

Dubsmash's UpdateSound GraphQL mutation lacked ownership checks on the uuid parameter, letting any authenticated user rename any soundtrack in the public music library.

- Payout: $3,000
- Severity: medium
- Program: Reddit
- Found by: Sandeep Hodkasia (@sandeephodkasia)
- Disclosed: 2021-12-07
- Write-up quality: 6/10
- Original: https://web.archive.org/web/20240304202752/https://appsecure.security/how-i-was-able-to-change-reddit-acquired-dubsmashs-music-library-sound-tracks/
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20240304202752-https-appsecure-security-how-i-was-able-to-change-reddit-acquired-dubsmashs-music-lib
- Tags: area:mobile domain:api domain:mobile impact:integrity kind:bounty platform:blog sev:medium tech:graphql tech:ios technique:source-review vuln:access-control vuln:idor

**Target:** GraphQL API endpoint (UpdateSound mutation) on gateway-production.dubsmash.com
**Root cause:** The UpdateSound GraphQL mutation accepted a user-supplied soundtrack uuid without verifying it belonged to the authenticated user, so any valid session could mutate arbitrary soundtrack objects.
**Steps:**
1. Upload a soundtrack under 'My Sounds' in the Dubsmash iOS app.
2. Edit the soundtrack title and capture the UpdateSound GraphQL POST in Burp.
3. Obtain another soundtrack's uuid (disclosed in responses of multiple APIs).
4. Replace `"uuid":"<own>"` in the `variables.input` with the victim soundtrack uuid, e.g. `{"input":{"uuid":"a687eb61ad814a09a8a85cedef7837f3","name":"test12355556777"}}`.
5. Forward the request to `https://gateway-production.dubsmash.com/graphql?build_number=45431&platform=ios`; the victim soundtrack title is changed.
**How found:** While researching the Dubsmash iOS app, the researcher edited a soundtrack title, captured the GraphQL request, and noticed the object was referenced solely by a client-supplied uuid with no ownership binding, prompting a swap test.
**Exploitation:** Any authenticated user with a Bearer token could replay the UpdateSound mutation with an arbitrary publicly-known soundtrack uuid and set a new name, modifying titles in the shared music library; an automated script could rename the entire library.
**Escalation:** Scripting the mutation across all known soundtrack uuids to mass-modify the entire music library.
**Insight:** On mobile GraphQL backends, capture self-service mutations (rename/edit) and swap the object identifier for one harvested from other API responses; object uuids leaking in list/detail responses make BOLA trivially exploitable at scale.