Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data

Meta paid a **$78,000** bounty after a security researcher found a **broken access control** flaw in Meta’s **customer support** infrastructure. The issue could expose **customer support data**, which is why the report earned a large payout rather than a routine triage note.

Broken access control means the system failed to enforce who could see or act on support records. In support tooling, that often sits behind agent portals, ticket systems, and internal APIs that trust session state, role checks, or object IDs too loosely. When those checks fail, an outsider or low-privilege actor can reach data meant only for authorized support staff.

For engineers building support stacks, the lesson is direct: access rules must follow the data, not the UI. Ticket IDs, user lookups, attachment links, and admin endpoints need server-side authorization on every request. Support systems hold PII, account history, and recovery workflows, so a single missing check can turn a helpdesk feature into a data-exposure path.

In market terms, a **$78,000** Meta bounty signals that major platforms still treat support infrastructure as high-value attack surface and will pay accordingly. Bug bounty programs reward researchers who prove real access-control failures, not only flashy remote code execution. That pressure keeps support tooling under the same scrutiny as core product APIs.

Watch for follow-through on how Meta hardens support access paths after this report, and audit your own ticket systems for IDOR-style object access, weak role gates, and shared “support” credentials. Treat every support data endpoint as customer-data production code, with authz tests and least-privilege roles as the baseline.