Disclose Hidden Comments on Media Section of hub.vroid.com

I discovered a vulnerability related to hidden comments in the Media section on https://hub.vroid.com. Initially, a user allowed comments on their media post but later disable them, making all comments invisible to everyone except the admin. However, by intercepting a request where a user can like …

POST /api/statuses/PASTE_ID_HERE/hearts HTTP/2
Host: hub.vroid.com
Cookie: ATTACKER_COOKIES
Sec-Ch-Ua: "Opera";v="109", "Not:A-Brand";v="8", "Chromium";v="123"
Accept: application/json, text/plain, */*
Content-Type: application/json
X-Api-Version: 11
Sec-Ch-Ua-Mobile: ?0
Content-Length: 2

{}