# Reddit talk promotion offers don't expire, allowing users to accept them after being demoted

Reddit Talk speaker/host promotion offerIds never expire, letting a demoted user replay the accept request to regain speaker/host role.

- Payout: hidden
- Severity: medium
- Program: Reddit
- Found by: ahacker1
- Disclosed: 2022-10-03
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1656380
- Library page: https://bugbountylibrary.com/r/h1%3A1656380
- Tags: area:web3 domain:web impact:privesc kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:access-control vuln:business-logic vuln:idor

**Target:** gql.reddit.com GraphQL mutation accepting talk promotion offerId
**Root cause:** Promotion offerIds are not invalidated after acceptance or upon demotion, so the accept mutation remains replayable indefinitely.
**Steps:**
1. Create Reddit Talk as UserA (victim/host).
2. Join talk as UserB (attacker).
3. As UserA promote UserB to speaker/host via avatar menu.
4. As UserB capture the accept request to `https://gql.reddit.com` with body `{"variables":{"platformUserId":"...","offerId":"UUID"},"id":"475c91dd4480"}`.
5. As UserA demote UserB to audience.
6. As UserB replay the captured request; observe promotion back to speaker/host, repeatable after each demotion.
**How found:** Noticed the accept-offer request could be replayed after demotion, hypothesizing offerIds lacked expiry/invalidation.
**Exploitation:** Attacker captures their own promotion-accept GraphQL request, waits to be demoted, then replays it to reacquire speaker/host privileges at will, disrupting the talk.
**Insight:** For invite/offer-token flows, test replay after the state that granted the token is revoked (demotion, removal, role change) — acceptance often isn't tied to current authorization state.