Topcoder: IDOR on deleting drafts on https://apps.topcoder.com/wiki/users/viewmydrafts.action via discardDraftId parameter

2020-05-07T23:27:18
ID H1:868590
Type hackerone
Reporter powerpuff
Modified 2020-05-12T14:42:17

Description

Hi :)

On https://apps.topcoder.com/wiki/users/viewmydrafts.action, you can see your drafts, edit or delete them. Users can delete their own drafts on https://apps.topcoder.com/wiki/users/viewmydrafts.action?discardDraftId=<DRAFT_ID>. But there is no check and an attacker can change discardDraftId and delete all drafts.

Impact

An attacker can delete other user's drafts.