A critical broken access control vulnerability in Meta’s customer support infrastructure allowed attackers to read private support emails, chats, and case data belonging to other users, and even manipulate support workflows on their behalf.
Independent researcher Rony K Roy discovered the flaw, which Meta patched by April 2026 after awarding a 78,000 USD bounty for the report.
The vulnerability originated in Meta Horizon Managed Solutions, an enterprise platform used by organizations to manage Meta Quest devices and users.
Critical Meta IDOR Flaw
During testing, several support-related GraphQL operations were found to return data even when the requesting user lacked the permissions normally required to access support functionality, signaling a deeper authorization problem in the support stack.
What initially looked like a product-specific bug eventually proved to impact Meta.com support emails, support cases, and customer support chat experiences built on the same underlying infrastructure.
From a security classification perspective, the flaw maps to Insecure Direct Object Reference (CWE-639), Broken Access Control (CWE-284), and Missing Authorization (CWE-862), reflecting both object-level and workflow-level enforcement gaps.
An attacker could access Meta.com support email conversations, including communications between customers and Meta Support, as well as case metadata and internal summaries.
Customer support chat transcripts were similarly exposed, along with case notes, escalation details, and attachments associated with support requests.
Personal data voluntarily shared in support interactions such as names, email addresses, and phone numbers could be harvested at scale, and responses, updates, and other communications from Meta Support tied to affected cases were equally accessible.
Beyond passive data exposure, the bug enabled unauthorized actions: an attacker could create support requests on behalf of other Meta Horizon Managed Solutions organizations, change support case states, and add external users as subscribers to support cases without proper authorization.
WhiteAuth showed that multiple support experiences relied on common backend services and shared trust assumptions, some of which integrated Salesforce-backed workflows and data models, though the problem lay in Meta’s implementation rather than Salesforce itself.
Authorization checks were inconsistently enforced across these shared components, allowing the same weakness to manifest across Meta.com support emails, support cases, chat workflows, and related internal support information.
The situation was worsened by sequential support case identifiers, which made case enumeration trivial and enabled attackers to iterate through IDs and retrieve large numbers of otherwise protected support requests.
The issue was first reported to Meta in January 2026 with a relatively limited impact assessment centered on Horizon Managed Solutions.
Subsequent investigation revealed broader cross-vertical impact, significantly increasing the severity, and Meta completed remediation across affected systems by April 2026, stating it found no evidence of abuse of the vulnerability.
The public write-up was released only after patching and intentionally omits exploit-specific details, proof-of-concept code, and certain unconfirmed observations to prevent reproduction and avoid harming user security.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
