# Read Access to all comments on unauthorized forums' discussions! IDOR! 

Steam Community forum comment endpoint lacked permission checks, letting members read deleted comments and non-members read all comments on members-only forums via crafted POST.

- Payout: $500
- Severity: medium
- Program: Valve
- Credited: ta8ahi
- Disclosed: 2018-05-09
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/308610
- Library page: https://bugbountylibrary.com/r/h1%3A308610
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:medium technique:param-pollution vuln:access-control vuln:idor vuln:info-disclosure

**Target:** steamcommunity.com forum comment AJAX endpoint (/comment/ForumTopic/delete/)
**Root cause:** The comment-fetch endpoint trusted client-supplied extended_data (topic_permissions with can_view/can_moderate=1) and did not server-side verify the requester's forum membership or moderator rank before returning comments_raw, including deleted ones.
**Steps:**
1. Create forum where members can view discussions but not deleted comments; non-members cannot view discussions.
2. Delete some comments in a discussion.
3. As member, view-source the discussion page, find `ForumTopic_<GroupID>_<forumID>_<discussionID>` and note IDs.
4. Send `POST /comment/ForumTopic/delete/<GroupID>/<forumID>/` with member cookies and body `gidcomment=00000&comment=boom...x&start=0&count=15&sessionid=...&extended_data={"topic_permissions":{"can_view":1,...,"can_moderate":1,...}}&feature2=<discussionID>&oldestfirst=true&include_raw=true`.
5. Search response for `comments_raw` — deleted comments are returned.
6. Repeat with non-member cookies and IDs of a members-only forum (e.g. `ForumTopic_103582791461362746_1692659135923574526_1692659769940104935`); all comments including deleted are exposed.
**How found:** Noticed the client sends extended_data containing topic_permissions; hypothesized the server trusts these client-supplied permission flags instead of re-checking membership/moderator rank, then replayed the request with member and non-member sessions.
**Exploitation:** Attacker with any account (or none with forum access) sends the crafted POST with spoofed extended_data permissions and target forum/discussion IDs to exfiltrate all comments, including deleted ones, from forums they cannot view. No user interaction required.
**Insight:** When an AJAX endpoint receives a serialized permissions blob (extended_data) from the client, replay it with elevated flags (can_moderate/can_view=1) and a lower-privileged session — servers often trust client-supplied permission state for read endpoints.