[$538] IDOR allows friends to edit the date on their friends’ timeline posts on Facebook

Description/ImpactOn Facebook, User A is friends with User B, and User B can create posts on User A’s timeline. Normally, User A cannot edit the date a post was created by User B, and the UI does not provide such a feature. However, through this IDOR vulnerability, User A can edit the date of the post created by User B. This compromises the...