Using the most basic permissions, public_profile, it is possible to change the description/name
Any editable field (https://developers.facebook.com/docs/graph-api/reference/v2.2/video) of any of the session user’s videos. This is undocumented, though it seems, that a permission requirement should be applied to modify the video object.
Proof of Concept
Execute a HTTP POST call
curl -F 'name=My Potato Video'
-F 'access_token=ACCESS_TOKEN'
https://graph.facebook.com/video_id
The result is that video name has been changed from “Hot Video” to “My Potato Video”
This was patched and now asks for the publish_action permission.
Timeline
- Feb 25, 2015 6:59am – Report Sent
- Feb 25, 2015 6:24pm – Escalation by Facebook
- Mar 20, 2015 10:47am – Patched and Bounty Awarded by Facebook