# Able to access private picture/video/writing when requesting for their JSON response

FetLife's JSON content-type response path skipped authorization checks, letting any logged-in user read others' private pictures, videos, and posts by ID.

- Payout: hidden
- Severity: medium
- Program: FetLife
- Found by: trieulieuf9
- Disclosed: 2021-12-16
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1424291
- Library page: https://bugbountylibrary.com/r/h1%3A1424291
- Tags: area:web domain:web impact:data-leak impact:pii-leak kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:idor vuln:info-disclosure

**Target:** REST endpoint /users/{id}/pictures|videos|posts/{id}
**Root cause:** The endpoint branches on the Accept header; the JSON rendering path omits the authorization check that the HTML path enforces.
**Steps:**
1. Identify endpoint /users/{user-id}/pictures/{pic-id} returning HTML or JSON based on Accept header.
2. Send `curl https://fetlife.com/users/14104003/pictures/120041856 -H "Cookie: _fl_sessionid={session}" -H "Accept: application/json"`.
3. Observe JSON body of a private picture despite no ownership.
4. Repeat against /videos/{id} and /posts/{id} with same header.
**How found:** Noticed the endpoint returns two response formats depending on the Accept header, then tested whether the JSON variant enforced the same authorization as HTML.
**Exploitation:** Authenticated attacker supplies Accept: application/json to fetch private media/post JSON for any known asset ID, bypassing the HTML path's access control.
**Insight:** When an endpoint content-negotiates between HTML and JSON, test each representation separately for authz parity—alternate renderers often skip access checks the primary view enforces.