Automattic: IDOR when moving contents at CrowdSignal

Summary: Hi team, You can move your contents via Move to button at https://app.crowdsignal.com/dashboard And when you click to Move to My Content you will send a POST request to /dashboard like that : F893407 actionable parameter's value is the content's ID. And if you change this ID to victim's...