$4300 Instagram IDOR Bug (2022)

Hello everyone! Today im going to explain how i found a $4300 IDOR Bug on Instagram.

1. During my usual hunting routine, I have found a new feature in Instagram called “Interests” this new feature allows you to choose interests and topics you prefer to show up in your feed more often. For example (football, cars, etc..)
2. After digging into This feature I noticed in the post-data there was the Instagram target user id that belongs to my account, After I saw that I instantly went and changed it to my other account’s id to check for IDOR, and YES.. it worked! IDOR Bug that makes me able to add/modify and even delete any account’s favorite interests/topics.

Report timeline:

Report sent on: November 8th 2021

Bounty awarded: January 28th 2022

Bounty Amount: $4000 + $300 for the delay (69 days)

Pics below:

original bounty

bonus for the delay

Thanks for reading!

Don’t forget to leave comment on what you think about this write-up :-)

Good luck with your hunting everyone!