Getting access of mod logs from any public or restricted subreddit with IDOR vulnerability

Program: reddit Bug Type: IDOR Bounty: 5000 Date: 2022-08-03
IDOR Information-Disclosure sensitive-data broken-access-control

Summary

There was a vulnerability in reddit's GraphQL endpoint that enables any user to see moderator logs of any subreddit. The vulnerability could be reproduced by logging in as any user, and sending a request to gql.reddit.com with the data - {"id":"6243efcbc61d","variables":{"subredditName":"any-subreddit"}}, This dumped the moderator logs of any subreddit the user mentions. If the moderator logs had multiple pages, the response had a hasNextPage boolean key value pair indicating that. to see the next page take teh endCursor code value from the first response and simply add the variable "after": "code-from-endCursor".

References