Post in private groups after getting removed
该报告还没有中文解读。
原文摘录
摘自原文（456 字符中的一小部分）
1. A user(victim) have a private video and he have added it on his private groups. Now the group members can see it and comment to it. 2. The attacker is on the group and he adds a new comment and capture the request using burp proxy. 3. Then the attacker is removed from the group by the victim. …
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 Vimeo 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @niyaax · 版权归作者与 Vimeo 所有