Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data

Meta paid a **$78,000** bug bounty after a security researcher found a broken access control flaw in **Meta’s** customer support infrastructure that could expose customer support data. The report was covered by **SecurityWeek**. The core issue was not a novel exploit class; it was a control failure that let the wrong principal reach support-side records.

Broken access control means the system did not reliably enforce who may read or act on support resources. In support stacks that pattern often shows up as missing or weak checks on session identity, role, case ownership, or internal tools that sit beside the public product surface. The bounty size signals Meta treated the finding as high impact even without public detail on exact paths or record counts.

For engineers and builders, the lesson is operational: support systems hold identity, account, and case history and are often built and permissioned under different rules than the main app. If authorization is applied only at UI or “trusted internal network” layers, any token reuse, IDOR-style object reference, or mis-scoped support role can turn a help-desk path into a data exposure path. Access checks need to live on every read and write of support data, not only on login.

In market and competitive terms, large platforms fund bug bounties to buy continuous external review of secondary surfaces that product teams ship less carefully than core feeds or messaging. A six-figure payout for support infrastructure underlines that attackers and researchers both treat help and CRM-adjacent systems as high-value targets, not side channels.

Practical takeaway: inventory every surface that can touch support tickets, account recovery, or agent tools; require server-side authorization on object IDs and roles; and put those paths on the same review and bounty scope as production APIs. What to watch next is whether Meta or peers publish remediation patterns for support-plane access control, and whether similar bounties keep clustering on internal tooling rather than only public product endpoints.