🎯 New Report #3100570: Bypassing Inbox Privacy Settings and Enabling Spam on Pixiv.net
🔺Severity: Low
👽 Reporter: aaqibhussain
⭐️ Reputation: 224
🛠 State: resolved
💼 Team: pixiv
💵 Bounty: 200
🕐 Submitted: 2025-04-19
⏰ Disclosed: 2026-04-27 04:00:54
📝 Summary: A vulnerability was discovered in the messaging system of Pixiv.net. The vulnerability allowed any user to bypass the inbox privacy settings and send messages to another user who had disabled their inbox. The vulnerability was triggered by manipulating the id parameter in the message-sending POST request. Additionally, the lack of rate limiting or duplicate request validation allowed attackers to spam users by repeatedly sending the same or modified requests.
📂 Report JSON File: 3100570
@hackeronereports