# A user can post comments on other user's private videos

Vimeo comment endpoint lacked authorization re-check, letting a user post comments on another user's private video by replaying a captured request.

- Payout: hidden
- Severity: medium
- Program: Vimeo
- Found by: satishb3
- Disclosed: 2015-03-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/50829
- Library page: https://bugbountylibrary.com/r/h1%3A50829
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium technique:source-review vuln:access-control vuln:auth-bypass vuln:idor

**Target:** Comment POST endpoint /<video_id> with album context
**Root cause:** The add_comment endpoint authorized based on the album context_id/context_type rather than re-validating the caller's access to the now-private video, so a previously captured request still succeeded after the video was made private.
**Steps:**
1. As Alice create video 118026546 with 'Allow anyone to see my videos'.
2. As Bob create album 3295969 and add Alice's video to it.
3. Open https://vimeo.com/album/3295969/video/118026546 and submit a comment, capturing the request in Burp: `POST /118026546` with body `text=test&action=add_comment&token=...&version=...&group_id=3295969&context_id=3295969&context_type=album&add_comment=Add%20a%20new%20comment`.
4. As Alice set the video to private ('only me' -> 'apply to all existing videos').
5. As Bob the album URL now shows 'permission denied', but replaying the captured POST still adds a comment to the private video.
**How found:** Noticed that the comment request carried album context parameters (context_id/context_type=album) and hypothesized the endpoint authorized on album membership rather than current video visibility, then tested by flipping the video to private and replaying.
**Exploitation:** Attacker captures a legitimate comment request while the video is public, then replays it after the owner makes the video private; the server accepts it despite the attacker no longer having view access.
**Insight:** When a write endpoint carries context_id/context_type parameters, test whether authorization is bound to that context object instead of the target resource; capture the request while access is valid, then revoke access (privatize) and replay to check for stale authorization.