# [Studio.twitter.com] See someone else pics

Studio.twitter.com library list endpoint lacked authorization on owner_id, letting any logged-in user view, upload, delete and tweet media as another account.

- Payout: hidden
- Severity: high
- Program: X / xAI
- Found by: anandpingsafe
- Disclosed: 2017-06-22
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/164649
- Library page: https://bugbountylibrary.com/r/h1%3A164649
- Tags: area:web domain:web impact:ato impact:data-leak kind:bounty platform:hackerone sev:high tech:rest vuln:access-control vuln:auth-bypass vuln:idor

**Target:** studio.twitter.com /1/library/list.json REST endpoint
**Root cause:** The library list endpoint trusted the client-supplied owner_id parameter without verifying it matched the authenticated session, so any logged-in user could act on another user's media library.
**Steps:**
1. Log in to studio.twitter.com.
2. Request `GET /1/library/list.json?account_id=4503599659510351&owner_id=12&limit=20&offset=0` with Host: studio.twitter.com.
3. Change `owner_id` to another user's Twitter user id to view their private videos/pics.
4. Per researcher summary, the same owner_id control also allows uploading, deleting media and tweeting from the victim account.
**How found:** Noticed the endpoint accepted an owner_id parameter and tested substituting another user's id, observing access to data not belonging to the session.
**Exploitation:** Authenticated attacker substitutes a victim's publicly known Twitter user id into owner_id on the library endpoint to read private media; the same parameter reportedly enables upload, delete and tweet actions against the victim's account.
**Escalation:** From read-only media disclosure to account actions (upload/delete/tweet) via the same owner_id parameter.
**Insight:** On media/asset management consoles, enumerate every endpoint taking an owner_id/account_id and test whether the server derives identity from the session or trusts the parameter; the same parameter often gates write actions too.