Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data

Logging the task, then drafting the paragraphs from only the facts you provided.A security researcher found a broken access control flaw in Meta’s support infrastructure and reported it through the company’s bug bounty program. Meta paid a $78,000 bounty for the report. The issue involved exposure of customer support data rather than a surface-level UI bug.

Broken access control means the system failed to enforce who could reach support records that should have been restricted. In support platforms, tickets, account context, and case notes often sit behind shared tooling used by agents and automated workflows. When authorization checks are missing or incomplete on those paths, a request that should be denied can return data that belongs to another user or case.

For engineers building support consoles, helpdesk backends, or CRM integrations, this is a direct reminder that access rules cannot stop at the login gate. Every support API, internal admin route, and lookup by ticket ID or user ID needs an authorization check that ties the caller to the resource. “Authenticated” is not the same as “authorized to read this customer’s support history.”

Bug bounties at this scale show that large platforms still treat support systems as high-value attack surface. Customer support stacks hold identity details, issue narratives, and account state that are useful for social engineering and account takeover. Meta’s payout signals that researchers and programs continue to prioritize authorization failures over flashier but lower-impact bugs.

What to watch next is whether similar support-path access control issues appear in other large consumer platforms, and whether teams treat support APIs with the same object-level authorization tests they already apply to user-facing product APIs. The practical takeaway is simple: audit support and admin endpoints for IDOR-style and role-bypass cases, and require resource-scoped checks on every read of customer support data.A security researcher found a broken access control flaw in Meta’s support infrastructure and reported it through the company’s bug bounty program. Meta paid a $78,000 bounty for the report. The issue involved exposure of customer support data rather than a surface-level UI bug.

Broken access control means the system failed to enforce who could reach support records that should have been restricted. In support platforms, tickets, account context, and case notes often sit behind shared tooling used by agents and automated workflows. When authorization checks are missing or incomplete on those paths, a request that should be denied can return data that belongs to another user or case.

For engineers building support consoles, helpdesk backends, or CRM integrations, this is a direct reminder that access rules cannot stop at the login gate. Every support API, internal admin route, and lookup by ticket ID or user ID needs an authorization check that ties the caller to the resource. “Authenticated” is not the same as “authorized to read this customer’s support history.”

Bug bounties at this scale show that large platforms still treat support systems as high-value attack surface. Customer support stacks hold identity details, issue narratives, and account state that are useful for social engineering and account takeover. Meta’s payout signals that researchers and programs continue to prioritize authorization failures over flashier but lower-impact bugs.

What to watch next is whether similar support-path access control issues appear in other large consumer platforms, and whether teams treat support APIs with the same object-level authorization tests they already apply to user-facing product APIs. The practical takeaway is simple: audit support and admin endpoints for IDOR-style and role-bypass cases, and require resource-scoped checks on every read of customer support data.