# IDOR allows an attacker to modify the links of any user

GraphQL IDOR on gql.reddit.com let any authenticated user read and overwrite any other user's profile social links by supplying their link id.

- Payout: hidden
- Severity: high
- Program: Reddit
- Found by: criptex
- Disclosed: 2022-09-30
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1661113
- Library page: https://bugbountylibrary.com/r/h1%3A1661113
- Tags: area:web3 domain:api impact:integrity kind:bounty platform:hackerone sev:high tech:graphql vuln:access-control vuln:idor

**Target:** gql.reddit.com GraphQL socialLinks mutation
**Root cause:** The socialLinks update mutation authorizes by link id only, without verifying the link belongs to the requesting user, so any authenticated user can mutate another user's link by id.
**Steps:**
1. Send `POST /` to `gql.reddit.com` with `{"id":"11a239b07f86","variables":{"username":"<victim>"}}` to fetch the victim's profile social links including each link `id`.
2. Take a victim link `id` from the response.
3. Send `POST /` with `{"id":"c558e604581f","variables":{"input":{"socialLinks":[{"outboundUrl":"https://www.hackerone.com","title":"hacker","type":"CUSTOM","id":"<victim link id>"}]}}}`.
4. Reload the victim's profile (may need refresh/wait) to confirm the link title and URL were changed.
**Exploitation:** Attacker authenticates with their own account, queries any username to harvest link ids, then submits the update mutation with the victim's link id to overwrite title and outboundUrl, redirecting victims' profile links to attacker-controlled URLs.
**Insight:** GraphQL mutations that take a nested object id (e.g. socialLinks[].id) often authorize on the parent session rather than object ownership; enumerate ids via a read query on another user then replay them in the write mutation.