Description

It was observed that we can archive any users post using archive option by changing the post id.

1> Created user with lolwa username.
2> Posted a post and identified it's post id 1007.
3> Now get the post id from demo user i.e 1006.
4> Now click on archive for post id 1007 from user lolwa.
5> Intercept the request and changed the post id 1007 to 1006 (1006 is post id from demo user).
6> it was observed that i can archive any users post by changing the post id.

Proof of Concept

https://drive.google.com/drive/folders/1If4VFFxHecgKPOy8K1mBoVNTzyvib_nW?usp=share_link

Impact

We can archive any users post (public / private).