“We can build upon the previous vulnerability ‘Read other people’s messages’ and we can access the attachments (images and videos) that have been shared between users.”
FORTBRIDGE found Feeld let any user read other people’s chats, open their shared photos and videos without authentication, edit their messages and rewrite their profiles. Free users got every premium detail in the API response, and only the app hid it. Feeld got the report on March 8 and spent five months asking for more time. A dating app built for kinks kept its access control in the user interface.