Meta Paid $78,000 Bounty for Vulnerability Exposing Customer Support Data

A security researcher found a broken access control flaw in Meta’s support infrastructure and was paid a $78,000 bounty for reporting it. The issue allowed exposure of customer support data, according to SecurityWeek’s coverage of the award.

The vulnerability was a broken access control problem in Meta’s support stack, not a cryptography or injection bug. In practice that class of defect means authorization checks failed to enforce who could read or act on support-related records, so a principal who should not have seen certain customer support data could reach it through the support path.

For engineers building support portals, admin tools, or agent consoles, the finding is a direct reminder that support systems sit on sensitive identity, account, and case data. Access control has to be enforced server-side per resource and role, not only by hiding UI, and support workflows need the same least-privilege review as product APIs.

Bug bounties at this size show how seriously large platforms price support-side data exposure. Meta’s payment puts a concrete dollar figure on that risk and sits in a market where peer companies also run public bounty programs for similar classes of access-control and data-exposure bugs.

Builders should treat support and customer-care surfaces as first-class security boundaries: map which roles can read case history, PII, and account metadata; test for IDOR and other broken access control on those routes; and watch for follow-on write-ups that name the exact control failure so teams can add matching regression checks.